Job description
Position Overview: Head of Security Operations (SecOps)
The Head of Security Operations (SecOps) will serve as the strategic and technical leader for our enterprise cyber defense organization. Reporting directly to the Chief Information Security Officer (CISO), this hands-on leadership role is accountable for the resilience, protection, and operational security of Vanguard Media Group's hybrid cloud and on-premises environments.
The ideal candidate brings deep technical command of Security Incident Response and Management (SIRM), threat intelligence, proactive threat hunting, and modern SOC operations. You will manage an internal team of security analysts while driving high performance from external Managed Security Service Providers (MSSPs).
Key Responsibilities
Operational Leadership & Governance
Team Management: Lead, mentor, and build a team of 4-5 internal security analysts while driving vendor performance and SLA adherence for third-party MSSPs and SOC partners.
Financial & Project Management: Manage SecOps technology budgets, tool procurement, vendor contracts, and security deployment projects across the Cyber Defense organization.
Metrics & Reporting: Define, monitor, and report key operational SecOps metrics and KPIs to the CISO and executive leadership.
Compliance & Standards: Ensure SecOps processes align with enterprise risk standards and international regulatory frameworks, including NIST, ISO/IEC 27001, GDPR, and SOC 2.
Cyber Defense, Detection & Threat Hunting
Detection Engineering: Continuous maturation of correlation rules, detection logic, and automation playbooks across SIEM (Splunk/Sentinel), EDR, and SOAR tools mapped to the MITRE ATT&CK framework.
Threat Intelligence & Hunting: Integrate proactive threat intelligence feeds into operational tools to anticipate emerging threat actor campaigns, tactics, techniques, and procedures (TTPs), particularly those targeting the media and broadcasting sectors.
Industry Collaboration: Maintain relationships with government cyber agencies, threat-sharing communities, and external security researchers to enhance organizational intelligence.
Incident Response & Crisis Management
Incident Escalation & SIRM: Act as the primary escalation point and tactical commander for major security incidents, directing containment, eradication, remediation, and root-cause analysis.
Resilience Testing: Establish, update, and routinely stress-test Incident Response (IR) playbooks, containment procedures, crisis management escalation pathways, and disaster recovery workflows.
Post-Incident Review: Deliver post-mortem analyses and executive briefings following major incidents to ensure continuous operational improvement.
Architecture & Cross-Functional Integration
Infrastructure Collaboration: Partner with Cloud, Infrastructure, and DevOps teams to architect and maintain security solutions, including firewalls, IDS/IPS, identity & access management (IAM), and data encryption.
Pipeline Security: Embed security controls directly into media streaming, content delivery networks (CDNs), and digital publishing workflows.
Candidate Profile & Qualifications
Required Qualifications & Experience
Cybersecurity Background: Minimum 7+ years of progressive cybersecurity experience, with at least 3 years in a leadership or managerial capacity within a Security Operations function.
Incident Leadership: Demonstrated track record leading enterprise incident response, complex threat investigations, and cyber crisis management.
SOC & MSSP Oversight: Proven experience managing hybrid or outsourced SOC models, including contract oversight and service level enforcement.
Technical Stack: Deep expertise operating modern SIEM platforms (e.g., Microsoft Sentinel, Splunk), SOAR automation, EDR tools, and Threat Intelligence Platforms (TIPs).
Framework Mastery: In-depth knowledge of the MITRE ATT&CK framework and experience building detection coverage across attack vectors.
Cloud Security: Hands-on experience with security controls across major cloud platforms (AWS, GCP, or Azure), preferably within high-availability streaming or media delivery networks.
Scripting & Query Languages: Proficiency in data query languages (e.g., KQL, SPL) and scripting capabilities (e.g., Python, PowerShell) for detection creation and investigation automation.
Professional Certifications & Education
Core Security Certifications (Preferred): CISSP, CISM, GIAC Certified Incident Handler (GCIH), EC-Council Certified Incident Handler (ECIH), or CCSP.
Cloud Certifications (Advantageous): AWS Certified Security - Specialty, Microsoft Certified: Azure Security Engineer Associate, or equivalent platform credentials.