Public summary
Seeking a Director of Security Operations to lead global threat detection, security monitoring, incident response, and threat intelligence efforts within a major technology-driven local delivery platform headquartered in Berlin, Germany. This leadership role reports to the Chief Information Security Officer and manages CSIRT and SOC teams across multiple international entities. The position focuses on advancing security operations maturity with modern tools like Google SecOps, driving strategic initiatives, incident command, and fostering collaboration with local security teams worldwide. Candidates should have proven experience in SOC and incident response leadership, deep expertise in threat hunting, proficiency with cloud-native SIEM platforms, and strong communication and mentorship skills. The role benefits from a hybrid working model with on-site presence two days per week, offers comprehensive health and wellness benefits, educational support, and promotes diversity and inclusion.
Location and work setup
- Location
- Berlin
- Remote status
- Hybrid
- German requirement signal
- No German Required Detected
- Detected job language
- English
Responsibilities
Lead and mentor global CSIRT and SOC teams to deliver comprehensive security monitoring and incident response across worldwide entities. Define and execute a multi-year strategic roadmap to enhance threat detection, incident response, and threat intelligence to reduce organizational risk. Advance the detection mechanisms using tools like Google SecOps, focusing on high-fidelity detections and automation to improve detection and response times. Serve as the incident commander for major security incidents ensuring clear leadership, communication, and post-incident governance. Develop and integrate threat intelligence capabilities translating global threat actor tactics into proactive defense measures. Collaborate with local CISOs and security leaders to align security monitoring and response standards. Drive operational metrics and continuous improvement initiatives to demonstrate and enhance security effectiveness.
Qualifications
Proven track record leading Security Operations Centers and incident response teams in complex, large-scale enterprise or technology environments. Extensive expertise in managing major security incidents and designing proactive threat hunting programs. Hands-on experience with modern cloud-native SIEM and SecOps platforms, preferably including Google SecOps or Chronicle, with skills in detection engineering and automated response playbooks. Excellent communication and crisis management abilities to report technical incidents to various stakeholders including executives and legal partners. Demonstrated success in team mentorship and managing global operations. Experience establishing and monitoring key security metrics like Mean Time to Detect and Respond and detection coverage against frameworks such as MITRE ATT&CK. Strategic thinker capable of balancing urgent operational needs with long-term improvements. Additional certifications such as CISSP, CISM or relevant GIAC credentials and familiarity with multi-cloud environments are advantageous.