Cyber Defense Manager

Accountabilities:

• • Own Cyber Defense operations across SOC activities, detection engineering, incident response, threat detection, and exposure remediation.
  • Lead alert-triage quality, escalation processes, incident command, and coordinated response activities to ensure threats are handled rapidly and effectively.
  • Establish and continuously improve incident response standards, runbooks, playbooks, and operational procedures.
  • Prioritize critical vulnerabilities and security exposures based on asset criticality, exploitability, business impact, and risk.
  • Manage Cyber Defense dashboards, operational metrics, remediation tracking, and follow-up processes to maintain clear visibility into the security posture.
  • Partner with IT, Platform, Product, GRC, Legal, and business stakeholders during security incidents, investigations, and remediation initiatives.
  • Lead and develop the Cyber Defense team, including hiring, onboarding, coaching, mentoring, performance management, and retention of security talent.
  • Improve detection coverage across the environment by designing, validating, tuning, and expanding detection capabilities.
  • Reduce false positives and improve detection quality while maintaining effective coverage against relevant attack scenarios.
  • Use threat intelligence, incident findings, and lessons learned to continuously strengthen detection logic, response playbooks, and security controls.
  • Report on Cyber Defense performance, major incidents, operational metrics, and overall risk posture to security leadership and relevant executive stakeholders.
  • Drive measurable improvements in metrics such as mean time to detect (MTTD), mean time to respond (MTTR), detection coverage, and exposure aging.

  Requirements:

  • 10+ years of professional experience in Information Security, Cybersecurity, or a closely related discipline.
  • 3+ years of experience in a security management or team-lead position with direct people-management responsibilities.
  • Hands-on experience managing SOC operations, leading incident command, coordinating response activities, and improving MTTD and MTTR.
  • Strong expertise in designing, validating, maintaining, and tuning detection logic across SIEM, EDR, and cloud environments.
  • Deep understanding of security runbook development, alert triage, incident response, and false-positive reduction.
  • Strong knowledge of common attack scenarios, including account takeover, credential theft, privilege escalation, and data exfiltration.
  • Ability to map detection strategies and coverage to threat models such as MITRE ATT&CK.
  • Experience prioritizing vulnerabilities and exposures using CVSS, asset criticality, exploitability, and business impact.
  • Hands-on experience with at least one enterprise SIEM platform such as Splunk, Microsoft Sentinel, Chronicle, or Elastic, as well as SOAR tooling.
  • Understanding of cloud-native security controls and monitoring across AWS, GCP, or Azure environments.
  • Strong knowledge of IAM, PAM, SSO, and identity-related attack vectors relevant to detection and response.
  • Ability to define, track, interpret, and communicate security KPIs and operational dashboards to both technical teams and executive stakeholders.
  • Strong leadership and communication skills, with the ability to coordinate effectively across multiple functions during high-pressure situations.
  • Upper-Intermediate or higher English proficiency.
  • Fluent Ukrainian.
  • Experience in fintech, e-commerce, or other high-risk environments with complex threat landscapes is a strong advantage.
  • Previous hands-on experience as a SOC Analyst, Incident Responder, Detection Engineer, or similar technical security role is desirable.
  • Experience building a SOC or Cyber Defense function from the ground up, or significantly maturing an existing capability, is a plus.
  • Familiarity with threat intelligence platforms and threat-informed defense methodologies is beneficial.
  • Relevant certifications such as CISSP, CISM, GIAC GSOM, GCED, GCIH, or equivalent are advantageous.

  Benefits:

  • Fully remote working opportunity within Europe.
  • 20 paid vacation days per year.
  • 10 paid sick leave days per year.
  • Paid public holidays according to the approved company holiday calendar.
  • Medical budget to support healthcare needs.
  • Dedicated professional education budget for continuous learning and career development.
  • Language learning budget to support professional and personal development.
  • Wellness budget that can be used toward gym memberships, sports equipment, and related wellbeing expenses.
  • Opportunity to work in a leadership role with significant influence over Cyber Defense strategy, operations, and team development.
  • Exposure to complex security challenges and the opportunity to continuously improve detection, response, and risk-management capabilities.