Security & Threat Operations Manager

Overview

Lead DriveWealth's Security & Threat Operations function, protecting the brokerage platform and corporate environment. The role reports to the Chief Information Security Officer, grows and leads the team, and owns detection, incident response, and exposure management.

What you'll do

• Mature Security & Threat Operations through a measurable roadmap, defined operating model, appropriate monitoring coverage, escalation procedures, and service provider oversight.
• Grow and lead the team through hiring, coaching, training, career development, and performance management.
• Own the detection program, incorporating threat intelligence, detection content development, proactive hunting, and validation through attack simulations and purple-team exercises.
• Own security monitoring and investigation across product and corporate environments, including phishing, malware, credential compromise, API abuse, DDoS, and insider threats.
• Own digital risk monitoring covering external attack surfaces, leaked credentials, exposed data, impersonation, phishing domains, and takedown coordination.
• Partner with Security Engineering to build pre-defined automated security response actions, and coordinate with business leaders on response actions that cannot be automated or require compensating actions.
• Own the incident response lifecycle as Incident Commander, including preparedness, forensic evidence handling, containment, recovery validation, regulatory coordination, and post-incident improvement.
• Own the exposure management lifecycle from discovery through verified closure, coordinating remediation with accountable system and product owners.
• Own the operation and tuning of operational security controls such as DLP, WAF, email filtering, and identity compromise prevention.
• Partner with Legal, Compliance, Security Engineering and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-3 and 17a-4 controls.
• Partner with Security Engineering to automate control validation and evidence collection, support audits and regulatory examinations, and drive remediation of technical findings.

What you'll need

• 10+ years in security operations, detection engineering, incident response, or related disciplines, including 3+ years managing technical teams and experience building or maturing an operations function.
• Demonstrated experience serving as Incident Commander during significant security incidents, making decisions under pressure, coordinating multiple teams, and communicating clearly with executives and business stakeholders.
• Strong hands-on expertise in threat intelligence, detection content development, SIEM and endpoint analytics, investigation, threat hunting, and defensive validation.
• Practical scripting or query skills in Python, SQL, or comparable languages.
• Working knowledge of AWS, Kubernetes, API security, identity, and Windows/macOS endpoint telemetry.
• Strong people leadership, process design, and prioritization skills, with the ability to influence Engineering and IT, manage competing operational demands, and support on-call escalation and incident response outside normal business hours.
• Bachelor's degree in a related field or equivalent practical experience.

Nice to have

• Experience supporting production environments with demanding availability and latency requirements.
• Experience creating, operating, and tuning preventive controls such as DLP, WAF, and email filtering while managing false positives and business impact.
• Experience investigating insider threats and digital risks such as exposed credentials, impersonation, and phishing domains, with appropriate handling of sensitive information and coordination with HR and Legal.
• Familiarity with NIST CSF, incident response practices, and MITRE ATT&CK.
• Experience in regulated financial services, including SEC/FINRA environments and applicable incident, data protection, and recordkeeping obligations.
• Relevant certifications such as CISSP, GCIH, GCIA, or GCFA.

Details

• Open to candidates in New York City, Chicago, Austin, Dallas, Denver, Miami, San Francisco Bay Area, or Seattle.
• New York and Chicago based roles are expected to come into the office on a cadence set by the Hiring Manager/Team.
• Austin, Dallas, Denver, Miami, San Francisco, and Seattle based roles are fully remote, with occasional visits to onsite offices.
• Out-of-hours on-call escalation and incident response support is required.
• Applicants must be currently authorized to work in the United States on a full-time basis without current or future visa sponsorship.
• Pay range: $200,000 – $250,000 USD.