Security Operations Team Lead at Cyera in US Remote, NY

Job description

WHO WE ARE Come join the company at the center of how the world adopts AI securely. Cyera’s mission is to give enterprises the confidence to embrace AI safely — deciding exactly what it can see and do as it reaches deeper into the business. We started by solving the hardest problem in data security: finding and securing data faster and more precisely than anyone thought possible. That foundation is now the essential AI trust infrastructure for the Fortune 1000. We’re hiring mission-driven talent to put those leaders at the center of our story. THE OPPORTUNITY Join our team as the Security Operations Team Lead. You will lead a team of Security Operations Engineers, serve as incident commander for major incidents, and own the day-to-day health and improvement of our agentic SOC. You will also run our customer zero program, in which we operate the Cyera platform on our own environment and feed what we learn back to Product. This is a player-coach role: you lead the team and stay hands-on. The ideal candidate has 5 or more years in security operations or incident response, including senior or lead-level experience, has run significant incidents end to end, and has led or mentored engineers. RESPONSIBILITIES: Team Leadership: Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths. Incident Command: Direct the response to major incidents, make containment calls, manage stakeholder communication, and own the after-action process. SOC Operating Model: Own the metrics and roadmap for the agentic SOC and prioritize the improvements that move them. Agentic Fleet Management: Own the fleet of security agents that handle first-pass triage, investigation, and response: define guardrails and human approval points, evaluate accuracy, keep an audit trail, and report impact on autonomous handling and analyst capacity. Customer Zero Program: Own posture goals, remediation governance, the product feedback loop, and reporting for our internal Cyera deployment. Detection and Response Strategy: Set detection and response priorities with the Security Engineering lead based on threat model and coverage. Coverage: Design and run on-call and coverage arrangements, including any external or follow-the-sun support. Hands-On Work: Take the hardest investigations, build detections and playbooks, and write code, with AI-assisted workflows as the default way of working. Stakeholder Management: Represent Security Operations to security leadership and R&D; translate operational data into risk and status. Requirements REQUIRED QUALIFICATIONS: Experience: 5 or more years in security operations, incident response, or detection engineering, including senior or lead-level work. Incident Command: Experience running significant incidents end to end, including executive communication. Leadership: Experience leading, mentoring, or managing engineers or analysts. AI-Assisted Workflows: Hands-on experience running AI-assisted and agent-based security workflows, with a clear view of where agents are reliable, where they fail, and how to measure both. AWS Knowledge: Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response. AWS Certification: AWS Security Specialty or Solutions Architect Associate, or equivalent demonstrated depth. Technical Depth: Strong Python and detection engineering across SIEM and cloud telemetry; able to review and improve others' work. Operating Discipline: Experience defining metrics, running an operational cadence, and reporting to leadership. Communication: Clear with executives and engineers; calm and decisive under pressure. Nice to Have Data Security: Experience with DSPM, DLP, or operating a security product as an internal customer. Regulated Environments: FedRAMP, SOC 2, or ISO 27001. Certifications: GCIH, GCFA, CISSP, AWS Security Specialty, or similar. COMPENSATION INFORMATION: Compensation Range: $150,000-225,000. The range represents total c