Security Operations, IR Lead

Erebor Security Operations, IR Lead

Location: New York City, NY, Newport Beach, CA or Columbus, Ohio

About the Role

The Head of Security Operations is a hands-on leadership role responsible for building and directing Erebor Bank’s operational security capabilities, including the Security Operations Center (SOC), Incident Response (IR), Threat Intelligence, Threat Hunting, and Detection Engineering functions. Reporting to the CISO, you will architect the operational security program from strategic vision through tactical execution, developing the people, processes, and technology needed to detect, respond to, and recover from cyber threats targeting the bank. The ideal candidate is a hands-on security leader who can build high-performing teams while establishing the operational cadence and playbooks necessary to defend a financial institution against sophisticated adversaries.

Key Responsibilities

Security Operations Center (SOC) & Detection Engineering

• Design and build the SOC operating model, including organizational structure, staffing plans, shift coverage models, and escalation procedures.
• Develop the cyber detection program, establishing processes for creating, testing, tuning, and maintaining detection rules, use cases, and analytics across
• SIEM, EDR, NDR, and cloud security platforms.
• Define and implement alert triage workflows, response procedures, and quality assurance processes to ensure consistent and effective analyst operations.
• Drive continuous improvement of detection coverage mapped to MITRE ATT&CK and relevant financial sector threat profiles.
• Oversee technology strategy for security operations tooling, including
• SIEM/SOAR platform selection, deployment, and optimization.
• Establish SOC performance metrics, SLAs, and reporting frameworks to measure operational effectiveness and drive accountability.
• Incident Response & Crisis Management
• Develop and implement the enterprise cyber incident response program, including IR plans, playbooks, communication templates, and severity classification frameworks.
• Build and lead the incident response team, establishing on-call rotations, escalation paths, and coordination procedures with IT operations, legal, communications, and executive leadership.
• Define forensic investigation capabilities, evidence handling procedures, chain-of-custody protocols, and relationships with external forensic firms and law enforcement.
• Lead response efforts for significant security incidents, coordinating cross-functional teams and managing executive communications during crisis events.
• Establish a post-incident review process to capture lessons learned, drive remediation actions, and continuously improve response capabilities.
• Ensure incident response processes meet regulatory notification requirements (OCC 36-hour rule, state breach notification laws, NYDFS 72-hour notification).
• Threat Intelligence & Threat Hunting
• Build the threat intelligence program, including intelligence collection, analysis, and dissemination processes tailored to the financial services threat landscape.
• Develop threat intelligence integration points across SOC operations, vulnerability management, risk assessment, and executive reporting.
• Establish threat hunting capabilities, including hypothesis-driven hunting methodologies, data source requirements, and hunting playbooks based on emerging TTPs.
• Build relationships with industry intelligence-sharing organizations (FS-ISAC, law enforcement agencies, peer institutions) and manage commercial threat intelligence feeds.
• Produce strategic threat assessments and intelligence briefings for CISO, executive leadership, and technical audiences.
• Drive purple team exercises and adversary emulation activities to validate detection and response capabilities.
• Program Development & Leadership
• Recruit, mentor, and develop a high-performing security operations team across
• SOC analysts, incident responders, detection engineers, threat intelligence analysts, and threat hunters.
• Establish program charters, operating models, and maturity roadmaps for all security operations functions.
• Develop and manage 24/7 operational coverage strategy, including decisions on in-house vs. managed service partnerships (MSSP/MDR).
• Collaborate with Security Architecture, GRC, IT Operations, and Engineering teams to ensure cohesive security posture and shared situational awareness.
• Manage operational budgets, vendor relationships, and technology investments for security operations capabilities.
• Provide regular operational reporting to the CISO, including threat landscape updates, incident trends, detection efficacy, and program maturity assessments.

Experience Required

• 7-10 years of progressive experience in information security, with at least 5 years in security operations, incident response, or threat intelligence leadership roles.
• Demonstrated experience building or significantly scaling security operations programs, including SOC buildout, IR program development, or threat intelligence function creation.
• Deep technical knowledge of security operations technologies (SIEM, SOAR,
• EDR, NDR, cloud security monitoring) and detection engineering practices.
• Strong understanding of the cyber threat landscape, attack frameworks (MITRE
• ATT&CK, Cyber Kill Chain), and adversary tradecraft relevant to financial institutions.
• Experience leading incident response for significant security events, including coordination with legal, regulatory, law enforcement, and executive stakeholders.
• Proven ability to recruit, develop, and retain high-performing technical security teams.
• Excellent communication skills with the ability to brief executive leadership and
• Board audiences on operational security posture and incident status.
• Bachelor’s degree in Information Security, Computer Science, or a related field (or equivalent experience).
• Bonus: Certifications such as CISSP, GCIH, GCIA, GCTI, GREM, and OSCP.
• Experience with major SIEM/SOAR platforms (DataDog, Sentinel One, Splunk,
• Microsoft Sentinel, Chronicle, Palo Alto XSOAR). Cloud security operations across AWS, Azure, and/or GCP. Military or intelligence community cyber operations background. Master’s degree.