Manager, Security Operations & Incident Response

About Us:

At Sitecore, our mission is to simplify how brands reach, engage, and serve people by delivering intelligent, personalised digital experiences that connect the world. We empower the world’s most iconic brands to build lifelong relationships with their customers—seamlessly, smartly, and at scale.

As the leading provider of agentic digital experience software, Sitecore brings together content, commerce, and data into one composable platform that enables brands to deliver millions of meaningful, adaptive experiences every day. Trusted by global leaders such as American Express, Porsche, Starbucks, and L’Oréal, Sitecore helps brands transform engagement through experiences that are not only personalised but predictive and dynamic.

Our foundation is our people—a diverse, passionate, and collaborative global team spanning over 25 countries. We believe that every experience matters, and that belief starts with how we work together. Our values guide how we lead, innovate, and connect. They are the behaviours that bring our mission and vision to life, every day, in every interaction.

As we continue to evolve, we are actively cultivating AI skills across our teams to unlock new levels of creativity, efficiency, and insight. From engineering to customer experience, AI capabilities are becoming integral to how we design, build, and deliver the next generation of digital experiences.

Learn more at Sitecore.com .

About the Role:

The Manager, Security Operations & Incident Response is responsible for leading Sitecore's Security Operations Center (SOC) and Incident Response (IR) functions. This role oversees daily security monitoring, detection, triage, investigation, containment, and response activities while ensuring effective collaboration with external security service providers and internal stakeholders.

You will drive the evolution of Sitecore's security operations capabilities toward an AI-assisted and automation-enabled operating model, leveraging machine learning, generative AI, autonomous workflows, and security orchestration technologies to improve detection quality, response speed, and operational efficiency. The role is accountable for establishing a modern, cloud-native SOC capable of supporting Sitecore's global SaaS business and for continuously improving the organization's cyber defense posture.

What You'll Do

Security Operations Leadership

Lead the day-to-day operations of the SOC and Incident Response function

Manage security monitoring, alert triage, investigation, escalation, containment, recovery, and post-incident analysis activities

Establish operational priorities, procedures, playbooks, metrics, and service levels

Ensure effective coverage across cloud, endpoint, identity, SaaS, and application environments

Maintain operational readiness for emerging threats, significant vulnerabilities, and security incidents

MSSP Management

Serve as the primary operational interface with Sitecore's Managed Security Service Provider (MSSP)

Define, monitor, and improve MSSP performance expectations and service levels

Review alert quality, escalation practices, investigation outcomes, and operational effectiveness

Drive continuous tuning and optimization of security monitoring capabilities

Ensure MSSP services align with Sitecore's security strategy and risk priorities

Incident Response

Lead cyber incident response activities and coordinate technical response efforts

Act as Incident Commander or designate response leadership during security incidents

Coordinate activities across Security, Engineering, Infrastructure, Product, Legal, Privacy, Communications, and other stakeholders as required

Ensure appropriate evidence collection, documentation, lessons learned, and corrective actions

Maintain incident response playbooks, procedures, and readiness exercises

Threat Detection & Monitoring

Own the effectiveness of security detections across all monitoring platforms

Drive improvement of detection coverage for identity, cloud, endpoint, SaaS, infrastructure, and application threats

Review and prioritize alerts from platforms including Wiz, Microsoft security technologies, cloud security tooling, and third-party detection sources

Partner with Security Engineering to implement and improve detection logic, workflows, and response automation

Vulnerability and Exposure Response

Own operational response processes for critical security findings and emerging threats

Coordinate investigation and response activities associated with Wiz findings, attack path analysis, and high-priority vulnerabilities

Support 0-day, KEV, and active exploitation response activities

Provide operational visibility into remediation progress and risk reduction activities

AI-Assisted Security Operations

Develop and execute the roadmap for an AI-assisted SOC

Identify opportunities to leverage AI for alert enrichment, investigation support, threat analysis, detection engineering, reporting, and operational efficiency.

Establish governance, controls, and oversight for AI-enabled security operations

Drive adoption of approved autonomous response capabilities where operationally appropriate

Lead the implementation of AI-assisted and autonomous containment actions for approved scenarios while ensuring appropriate human oversight, testing, and governance

Continuous Improvement & Metrics

Define and track SOC and IR performance metrics

Measure detection effectiveness, response effectiveness, automation adoption, containment speed, incident trends, and MSSP performance

Identify operational improvement opportunities and drive execution

Produce executive-ready operational reporting and status updates

Team Leadership

Recruit, develop, mentor, and lead security operations personnel

Establish clear accountability, performance expectations, and development plans

Build a high-performing operational security culture focused on continuous improvement and measurable outcomes

Foster strong collaboration across Security, Engineering, IT, Product, and Operations teams

What You'll Bring

SOC and Incident Response Leadership: Proven experience managing a Security Operations Center (SOC) and Incident Response (IR) function, including security monitoring, alert triage, threat investigation, containment, recovery, and post-incident reviews in a 24/7 environment

Cloud-Native Security Operations: Strong hands-on experience securing and monitoring cloud environments (AWS, Azure, or GCP), SaaS platforms, endpoints, identities, infrastructure, and applications within a global technology or SaaS organization

Major Incident and Crisis Management: Demonstrated experience leading complex security incidents as Incident Commander, coordinating technical response and cross-functional stakeholders, and managing evidence collection, incident communications, and remediation activities

MSSP and Security Tooling Management: Experience managing external MSSPs, defining SLAs and operational KPIs, evaluating service quality, and optimizing security monitoring and detection platforms such as Wiz and Microsoft security technologies (e.g., Sentinel, Defender)

Threat Detection, Vulnerability and Response Automation: Strong understanding of threat detection engineering, SIEM/SOAR, vulnerability and exposure management, threat intelligence, and response to critical vulnerabilities, zero-day exploits, KEVs, and active threats.

AI-Driven Security Operations and Automation: Demonstrated experience implementing or advancing AI-assisted security operations, leveraging machine learning, generative AI, automation, or autonomous workflows for alert enrichment, investigation, detection, and response, with appropriate governance and human oversight.

Why Join Sitecore?

At Sitecore, you will have the opportunity to shape the experiences behind digital products used by organizations around the world. You wil