Senior Manager, Security Operations

Overview

Build, lead and grow Motive's Security Operations Center as a founding leadership role, reporting to the CISO. You will own the full detection and response lifecycle across product and enterprise environments.

What you'll do

• Stand up and grow the SOC: operating model, coverage structure, runbooks, escalation paths, hiring and career development for a globally distributed team, and decide the 24/7 coverage model (in-house follow-the-sun, MDR-augmented or hybrid).
• Own detection strategy and coverage posture across both estates, treating detection content as code and mapping coverage against MITRE ATT&CK and Motive's threat model, with a live view of gaps closed in risk order.
• Extend detection into production and cloud workloads in close partnership with Platform Engineering, and build detections that span the boundary between corporate and production environments.
• Own 24/7 incident response across product and enterprise environments, serve as incident commander for significant incidents, and act as the voice to executives during an active incident.
• Own the security telemetry and analytics platform (collection, normalization, enrichment, retention and cost) and instrument the function on MTTD, MTTR, detection coverage, alert precision and automation rate.
• Establish a structured, hypothesis-driven threat hunting program and a threat intelligence capability tailored to Motive's sector, translating intel into detections, hunts and hardening priorities.
• Own EDR across the corporate fleet and, with Platform Engineering, runtime and workload protection for production.
• Own the operational side of phishing and social engineering defense (detection, reporting triage, takedown and credential-compromise response), partnering with the Compliance and Trust function, which owns simulation and awareness training.
• Architect the AI-first operating model for the SOC, personally building and iterating on triage, enrichment, correlation and investigation automation.

What you'll need

• 8+ years in security operations, incident response, detection engineering or threat intelligence, with 3+ years leading teams.
• Demonstrably hands-on: have personally written detections, run investigations, led incidents as commander and built automation, recently.
• Experience building or substantially rebuilding a SOC function, rather than only operating within an established one.
• Credible across both estates: production and cloud security monitoring as well as corporate and enterprise security operations. Candidates strong in only one should be ready to show how they would build the other.
• Deep experience with modern detection and response tooling, including SIEM and security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry, plus strong detection engineering skills you can apply personally.
• Strong background in cloud and container security monitoring, with AWS and Kubernetes strongly preferred, including introducing production monitoring without destabilizing production.
• Solid grounding in identity-centric attack paths: SSO, OAuth, session compromise, MFA bypass and privilege escalation across SaaS and cloud.
• Proven incident command experience on significant incidents, including executive communication under pressure, and the judgment to escalate appropriately.
• Concrete, demonstrated use of AI to run security operations (triage, enrichment, detection authoring, investigation support or reporting), with evidence of what was built, what it replaced and what it measurably changed.
• Experience building 24/7 coverage and leading globally distributed teams across multiple timezones.

Nice to have

• Experience in transportation, logistics, IoT and connected devices, or critical infrastructure.

Details

• Location: United States, remote.
• Base compensation range: $140,000 to $200,000 USD.
• Some interviews or new-hire training sessions may be held in person at one of Motive's global offices.
• Must be authorized to receive and access commodities and technologies controlled under U.S. Export Administration Regulations.
• Regarding US-based roles, candidates may be required to execute a non-compete covenant, subject to exceptions and statutory requirements by jurisdiction.