Supervisor for Global Security Operations Center at Enbridge. Leading a dedicated 24/7 team to monitor and protect global facilities and assets.
About the role
- Security Operations Lead overseeing global SOC operations and AI product integration at Replit. Leading monitoring and incident response across multi-cloud environments and AI workloads.
Responsibilities
- Lead, mentor, and scale a global SOC team responsible for 24/7 monitoring, alert intake, triage, correlation, and escalation.
- Build operational rigor: processes, runbooks, SLAs, metrics, and quality standards for high-scale environments.
- Cover monitoring across:
- - Cloud infrastructure (GCP, AWS, Azure)
- - Kubernetes/GKE/EKS/AKS clusters
- - SaaS platforms (Google Workspace, GitHub, Slack, Okta, etc.)
- - Endpoints (macOS, Linux, Windows) including EDR/XDR telemetry
- - Developer platforms + CI/CD pipelines
- - AI/ML systems and model-serving workflows
- Evaluate, adopt, and integrate AI-native SOC technologies for triaging, detection, and correlation.
- Identify opportunities to automate triage, investigations, enrichment, and reporting.
- Serve as the internal expert on the capabilities and limitations of AI-based SOC tooling.
- Own the entire SIEM ecosystem—ingestion, normalization, correlation, enrichment, tuning, dashboards, and metrics.
- Develop high-fidelity detections for:
- - Cloud-native attacks
- - Identity threats and lateral movement
- - SaaS misconfigurations and privilege abuse
- - Endpoint malware/behavior anomalies
- - Insider threats and account takeover patterns
- - Use MITRE ATT&CK, MITRE Cloud Matrix, and threat intel to drive detection coverage.
- Lead day-to-day triage and threat analysis activities, ensuring accurate categorization and prioritization.
- Drive complex investigations involving correlated events across cloud, SaaS, endpoints, and developer platforms.
- Guide root cause analysis and work with owners to drive remediation and architectural improvements.
- Communicate threats, gaps, and trends to leadership and engineering stakeholders.
- Partner with Cloud Security on cloud posture and preventative controls.
Requirements
- 7+ years of experience in Security Operations, with 3+ years in a senior or lead capacity.
- Experience leading or collaborating with 24/7 SOC environments (internal, hybrid, or MSSP).
- Strong experience with SIEM platforms (Chronicle, Splunk, Elastic, Sentinel, Panther, etc.).
- Deep understanding of:
- - Cloud security monitoring (GCP required; AWS/Azure preferred)
- - SaaS security monitoring (Okta, Google Workspace, GitHub, Slack, etc.)
- - Endpoint security telemetry (EDR/XDR tools such as CrowdStrike, SentinelOne, or Defender)
- - Kubernetes and container detection
- Hands-on detection engineering skills, event correlation, threat hunting, and log analysis.
- Familiarity with AI-based SOC platforms and LLM-driven detection/triage tools.
- Strong understanding of identity security, OAuth/OIDC, and API telemetry patterns.
- Experience with SOAR and scripting (Python, Go, Bash).
- Knowledge of MITRE ATT&CK, cloud kill chains, behavioral detections, and detection lifecycle management.
Benefits
- Competitive Salary & Equity
- 401(k) Program
- Health, Dental, Vision and Life Insurance
- Short Term and Long Term Disability
- Paid Parental, Medical, Caregiver Leave
- Commuter Benefits
- Monthly Wellness Stipend
- Autonoumous Work Environement
- In Office Set-Up Reimbursement
- Flexible Time Off (FTO) + Holidays
- Quarterly Team Gatherings
- In Office Amenities
Job title
Job type
Experience level
Salary
Degree requirement
Tech skills
Location requirements
Security Operations Analyst at Orion Health focusing on monitoring and maintaining security tools while collaborating with teams. Engaging with real - world threats and enhancing operational security processes.
Senior Global Security Analyst overseeing physical security operations at Dolby’s San Francisco headquarters. Collaborating with global partners to strengthen safety systems across Dolby locations.
Director overseeing integrated security operations, focusing on SOC management and cyber defense strategies for a fintech company in Canada.
Security Operations Engineer protecting Notion’s systems and users by investigating and responding to security events. Collaborating with a global team to enhance security processes and protocols.
SecOps Engineer at Aristocrat maintaining security for innovative iGaming platforms and collaborating with cross - functional teams. Focused on AWS services security and compliance assessments.
Cybersecurity Incident Response Analyst handling security events and incidents at Var Group in a hybrid work environment. Focused on ensuring response to security incidents and improving security processes.
Cybersecurity Incident Response Analyst handling security incidents and threats. Working in a hybrid environment at Yarix, a leader in digital evolution.
IAM Security Ops Analyst overseeing access management for clinical trial applications at Syneos Health. Collaborating with IT and compliance teams to enforce IAM policies and improve operational performance.
Fraud Operations Group Manager responsible for managing fraud management policies in the Operations Services team. Leading teams in minimizing fraud impacts while ensuring compliance and operational objectives.