Manager, Security Operations & Incident Response

About Us: At Sitecore, our mission is to simplify how brands reach, engage, and serve people by delivering intelligent, personalised digital experiences that connect the world. We empower the world’s most iconic brands to build lifelong relationships with their customers—seamlessly, smartly, and at scale. As the leading provider of agentic digital experience software, Sitecore brings together content, commerce, and data into one composable platform that enables brands to deliver millions of meaningful, adaptive experiences every day. Trusted by global leaders such as American Express, Porsche, Starbucks, and L’Oréal, Sitecore helps brands transform engagement through experiences that are not only personalised but predictive and dynamic. Our foundation is our people—a diverse, passionate, and collaborative global team spanning over 25 countries. We believe that every experience matters, and that belief starts with how we work together. Our values guide how we lead, innovate, and connect. They are the behaviours that bring our mission and vision to life, every day, in every interaction. As we continue to evolve, we are actively cultivating AI skills across our teams to unlock new levels of creativity, efficiency, and insight. From engineering to customer experience, AI capabilities are becoming integral to how we design, build, and deliver the next generation of digital experiences. Learn more at Sitecore.com . About the Role: The Manager, Security Operations & Incident Response is responsible for leading Sitecore's Security Operations Center (SOC) and Incident Response (IR) functions. This role oversees daily security monitoring, detection, triage, investigation, containment, and response activities while ensuring effective collaboration with external security service providers and internal stakeholders. You will drive the evolution of Sitecore's security operations capabilities toward an AI-assisted and automation-enabled operating model, leveraging machine learning, generative AI, autonomous workflows, and security orchestration technologies to improve detection quality, response speed, and operational efficiency. The role is accountable for establishing a modern, cloud-native SOC capable of supporting Sitecore's global SaaS business and for continuously improving the organization's cyber defense posture. What You'll Do Security Operations Leadership Lead the day-to-day operations of the SOC and Incident Response function Manage security monitoring, alert triage, investigation, escalation, containment, recovery, and post-incident analysis activities Establish operational priorities, procedures, playbooks, metrics, and service levels Ensure effective coverage across cloud, endpoint, identity, SaaS, and application environments Maintain operational readiness for emerging threats, significant vulnerabilities, and security incidents MSSP Management Serve as the primary operational interface with Sitecore's Managed Security Service Provider (MSSP) Define, monitor, and improve MSSP performance expectations and service levels Review alert quality, escalation practices, investigation outcomes, and operational effectiveness Drive continuous tuning and optimization of security monitoring capabilities Ensure MSSP services align with Sitecore's security strategy and risk priorities Incident Response Lead cyber incident response activities and coordinate technical response efforts Act as Incident Commander or designate response leadership during security incidents Coordinate activities across Security, Engineering, Infrastructure, Product, Legal, Privacy, Communications, and other stakeholders as required Ensure appropriate evidence collection, documentation, lessons learned, and corrective actions Maintain incident response playbooks, procedures, and readiness exercises Threat Detection & Monitoring Own the effectiveness of security detections across all monitoring platforms Drive improvement of detection coverage for identity, cloud, endpoint, SaaS, infrastructure, and application threats Review and prioritize alerts from platforms including Wiz, Microsoft security technologies, cloud security tooling, and third-party detection sources Partner with Security Engineering to implement and improve detection logic, workflows, and response automation Vulnerability and Exposure Response Own operational response processes for critical security findings and emerging threats Coordinate investigation and response activities associated with Wiz findings, attack path analysis, and high-priority vulnerabilities Support 0-day, KEV, and active exploitation response activities Provide operational visibility into remediation progress and risk reduction activities AI-Assisted Security Operations Develop and execute the roadmap for an AI-assisted SOC Identify opportunities to leverage AI for alert enrichment, investigation support, threat analysis, detection engineering, reporting, and operational efficiency. Establish governance, controls, and oversight for AI-enabled security operations Drive adoption of approved autonomous response capabilities where operationally appropriate Lead the implementation of AI-assisted and autonomous containment actions for approved scenarios while ensuring appropriate human oversight, testing, and governance Continuous Improvement & Metrics Define and track SOC and IR performance metrics Measure detection effectiveness, response effectiveness, automation adoption, containment speed, incident trends, and MSSP performance Identify operational improvement opportunities and drive execution Produce executive-ready operational reporting and status updates Team Leadership Recruit, develop, mentor, and lead security operations personnel Establish clear accountability, performance expectations, and development plans Build a high-performing operational security culture focused on continuous improvement and measurable outcomes Foster strong collaboration across Security, Engineering, IT, Product, and Operations teams What You'll Bring SOC and Incident Response Leadership: Proven experience managing a Security Operations Center (SOC) and Incident Response (IR) function, including security monitoring, alert triage, threat investigation, containment, recovery, and post-incident reviews in a 24/7 environment Cloud-Native Security Operations: Strong hands-on experience securing and monitoring cloud environments (AWS, Azure, or GCP), SaaS platforms, endpoints, identities, infrastructure, and applications within a global technology or SaaS organization Major Incident and Crisis Management: Demonstrated experience leading complex security incidents as Incident Commander, coordinating technical response and cross-functional stakeholders, and managing evidence collection, incident communications, and remediation activities MSSP and Security Tooling Management: Experience managing external MSSPs, defining SLAs and operational KPIs, evaluating service quality, and optimizing security monitoring and detection platforms such as Wiz and Microsoft security technologies (e.g., Sentinel, Defender) Threat Detection, Vulnerability and Response Automation: Strong understanding of threat detection engineering, SIEM/SOAR, vulnerability and exposure management, threat intelligence, and response to critical vulnerabilities, zero-day exploits, KEVs, and active threats. AI-Driven Security Operations and Automation: Demonstrated experience implementing or advancing AI-assisted security operations, leveraging machine learning, generative AI, automation, or autonomous workflows for alert enrichment, investigation, detection, and response, with appropriate governance and human oversight. Why Join Sitecore? At Sitecore, you will have the opportunity to shape the experiences behind digital products used by organizations around the world. You will work with talented colleagues across Product, Engineering, and Design to solve meaningful customer problems, influence product strategy, and help define the next generation of digital experiences. Equal Opportunities at Sitecore: Sitecore is proud to be an equal opportunity workplace. We are committed to equal employment opportunity without unlawful regard to race, color, ancestry, religion, gender, national origin, sexual orientation, age, citizenship, marital status, disability, veteran status, or any other locally legally protected characteristic.