Senior Security Operations Manager, Pure Storage

• 10+ years in cybersecurity, including 5+ years in detection, incident response, or SecOps leadership
• 5+ years of people management experience, including direct management of security engineering, detection engineering, or incident response teams, with responsibility for coaching, performance management, and team development
• Proven experience leading detection engineering and incident response teams at enterprise scale
• SIEM (Splunk preferred), SOAR (Tines, XSOAR), and EDR (CrowdStrike)
• Cloud telemetry and detection (CloudTrail, GuardDuty, VPC flow)
• Threat modeling, MITRE ATT&CK, and TTP-to-detection lifecycle
• Experience with detection-as-code practices, version control, and CI/CD pipelines
• Hands-on skills validating detections through replay, simulation, and log mining
• Familiarity with frameworks such as CIS Controls, NIST 800-53, and SOC 2
• Ability to translate complex security data into clear, executive-level insights
• Proven cross-team collaboration with Infra, GRC, Product Security, and App teams
• Strong written and verbal communication with an emphasis on clarity and measurable outcomes
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field, or equivalent practical experience

Desirable

• The Senior Manager, Security Operations – Detection Engineering & Incident Response will lead and evolve Pure’s Security Operations (SecOps) function across Detection Engineering, Threat Intelligence, and Incident Response (CIDR)
• The mission is to transform SecOps into a proactive, intelligence-driven, and outcome-oriented program that measurably reduces enterprise risk and strengthens security posture across cloud, SaaS, infrastructure, and endpoint environments
• This role sits at the intersection of detection, incident response, threat hunting, attack surface management, and platform security
• You’ll build and mature a high-signal detection and response system — from telemetry pipelines to actionable alerts — ensuring every detection maps to real attacker behavior and closes meaningful risk paths
• You’ll partner closely with leaders across GRC, Product Security, Infrastructure, IAM, and Engineering to operationalize risk-informed detections, mature IR processes, and drive measurable improvements in security posture
• Lead and mature the Detection Engineering and CIDR functions across threat detection, response workflows, incident triage, and automation
• Build and maintain a comprehensive detection inventory categorized by threat type, log source, MITRE mapping, and detection method
• Drive continuous validation through red team, purple team, and atomic testing
• Own key SecOps metrics such as MTTD, MTTR, and alert quality to improve signal-to-noise ratio and detection confidence
• Oversee ingestion of telemetry (AWS, Azure, SaaS, endpoint, network) into Splunk and SOAR pipelines
• Ensure incident response workflows are automated, repeatable, and outcome-focused
• Lead post-incident reviews and root-cause analyses, tracking corrective actions to closure
• Correlate threat intelligence, detection gaps, and hunt findings into prioritized roadmap updates
• Drive detection-to-remediation loops by partnering with ASM, Infra, IAM, AppSec, and GRC teams
• Produce dashboards that connect technical posture to business risk and ownership metrics
• Lead scenario-based tabletops, detection drills, and incident simulations

• There is no application deadline and we accept applications on an ongoing basis until the job is filled