Cyber Defense Unit Manager

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution.

We are looking for an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. You will build a high-performing team and continuously improve our ability to anticipate, detect, and respond to evolving cyber threats.

The ideal candidate combines deep cybersecurity expertise, operational leadership, and people management to build a modern, intelligence-driven cyber defense function. You are comfortable operating in a fast-paced global technology environment and can move seamlessly between strategy, hands-on operations, major incidents, and executive-level communication.

WHAT YOU’LL DO

Strategy and Leadership

Lead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement (e.g., against NIST CSF or SOC-CMM)

Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, ensuring coverage across time zones, including follow-the-sun or on-call models

Define the build-versus-buy approach for the function, including management of MDR/MSSP and other external partners, and manage the Cyber Defense budget

Security Operations, Monitoring, and Threat Hunting

Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments

Establish and maintain SOC processes, runbooks, severity definitions, and handoffs to ensure consistent, high-quality investigations

Lead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threats

Detection Engineering

Own the detection engineering lifecycle: use case development, testing, tuning, deployment, and retirement, with a focus on reducing false positives and alert fatigue

Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk

Ensure telemetry completeness by defining log source requirements and onboarding priorities with IT, Cloud, and Engineering

Run purple team and adversary emulation exercises to validate detection and response effectiveness

Incident Response

Lead response to significant cybersecurity incidents, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadership

Maintain and test incident response plans, playbooks, and crisis communication procedures, including regular tabletop exercises with senior stakeholders

Oversee digital forensics, evidence handling, containment, eradication, and recovery, working with Legal to preserve privilege and support investigations, legal holds, and regulatory inquiries

Support breach assessment and regulatory notification decisions with Legal and Compliance (e.g., GDPR, HIPAA, SEC disclosure, and other applicable obligations)

Run post-incident reviews and drive corrective actions to closure.

Threat Intelligence

Build and manage a threat intelligence capability that tracks threat actors, campaigns, and techniques relevant to Acronis, its customers, and the MSP ecosystem

Translate intelligence into actionable detections, hunts, blocking actions, and risk-informed recommendations for leadership

Participate in industry intelligence-sharing communities and partnerships (e.g., ISACs, peer groups, law enforcement liaison)

Technology, Automation, and AI

Own and optimize core cyber defense technologies, including SIEM, EDR/XDR, SOAR, and threat intelligence platforms, including roadmap, integrations, and vendor performance

Drive automation and AI-assisted capabilities to improve detection, enrichment, triage, investigation, and response, with appropriate governance and human oversight

Leverage Acronis’ own products and platform capabilities where appropriate to strengthen internal defense

Metrics, Reporting, and Executive Communication

Establish KPIs and reporting for cyber defense effectiveness, such as MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposure

Report cyber defense posture, major incidents, and risk trends to senior leadership, and when needed the Board and Audit Committee

Cross-Functional Partnership

Partner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security posture

Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization

Support audits, customer assurance requests, and regulatory requirements related to monitoring and incident response

WHO WE’RE LOOKING FOR

Significant cybersecurity experience (typically 10+ years) in security operations, incident response, threat detection, or cyber defense, including 5+ years leading teams

Proven experience leading cybersecurity teams within a global technology or software environment, including distributed, multi-time-zone teams

Demonstrated experience leading major incident response efforts from detection through recovery and post-incident review

Strong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CK

Hands-on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including evaluation and optimization

Experience with threat hunting and detection engineering, including detection-as-code practices

Strong understanding of AWS, Azure, or other modern cloud environments, including cloud-native logging, detection, and response

Experience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirements

Experience leveraging automation, scripting (e.g., Python), and ideally AI within security operations

Experience managing budgets, vendors, and managed security service providers

Strong leadership, analytical, and decision-making skills, particularly during high-pressure incidents

Ability to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiences

High integrity and sound judgment when handling sensitive, confidential, and privileged information

Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP are a plus

WHO WE ARE

A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses.

Our corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.

OUR INTERVIEW PRACTICES

To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you—not a digital assistant. To help maintain this integrity, we ask to remove virtual ba