Cyber Defense Unit Manager
Confirmed on the employer's own hiring board on Nov 9, 2026. First seen by Alion on Nov 5, 2026.
We are looking for an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. You will build a high-performing team and continuously improve our ability to anticipate, detect, and respond to evolving cyber threats.
The ideal candidate combines deep cybersecurity expertise, operational leadership, and people management to build a modern, intelligence-driven cyber defense function. You are comfortable operating in a fast-paced global technology environment and can move seamlessly between strategy, hands-on operations, major incidents, and executive-level communication.
WHAT YOU’LL DO
Strategy and Leadership
- Lead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement (e.g., against NIST CSF or SOC-CMM)
- Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, ensuring coverage across time zones, including follow-the-sun or on-call models
- Define the build-versus-buy approach for the function, including management of MDR/MSSP and other external partners, and manage the Cyber Defense budget
Security Operations, Monitoring, and Threat Hunting
- Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments
- Establish and maintain SOC processes, runbooks, severity definitions, and handoffs to ensure consistent, high-quality investigations
- Lead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threats
Detection Engineering
- Own the detection engineering lifecycle: use case development, testing, tuning, deployment, and retirement, with a focus on reducing false positives and alert fatigue
- Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk
- Ensure telemetry completeness by defining log source requirements and onboarding priorities with IT, Cloud, and Engineering
- Run purple team and adversary emulation exercises to validate detection and response effectiveness
Incident Response
- Lead response to significant cybersecurity incidents, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadership
- Maintain and test incident response plans, playbooks, and crisis communication procedures, including regular tabletop exercises with senior stakeholders
- Oversee digital forensics, evidence handling, containment, eradication, and recovery, working with Legal to preserve privilege and support investigations, legal holds, and regulatory inquiries
- Support breach assessment and regulatory notification decisions with Legal and Compliance (e.g., GDPR, HIPAA, SEC disclosure, and other applicable obligations)
- Run post-incident reviews and drive corrective actions to closure.
Threat Intelligence
- Build and manage a threat intelligence capability that tracks threat actors, campaigns, and techniques relevant to Acronis, its customers, and the MSP ecosystem
- Translate intelligence into actionable detections, hunts, blocking actions, and risk-informed recommendations for leadership
- Participate in industry intelligence-sharing communities and partnerships (e.g., ISACs, peer groups, law enforcement liaison)
Technology, Automation, and AI
- Own and optimize core cyber defense technologies, including SIEM, EDR/XDR, SOAR, and threat intelligence platforms, including roadmap, integrations, and vendor performance
- Drive automation and AI-assisted capabilities to improve detection, enrichment, triage, investigation, and response, with appropriate governance and human oversight
- Leverage Acronis’ own products and platform capabilities where appropriate to strengthen internal defense
Metrics, Reporting, and Executive Communication
- Establish KPIs and reporting for cyber defense effectiveness, such as MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposure
- Report cyber defense posture, major incidents, and risk trends to senior leadership, and when needed the Board and Audit Committee
Cross-Functional Partnership
- Partner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security posture
- Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization
- Support audits, customer assurance requests, and regulatory requirements related to monitoring and incident response
WHO WE’RE LOOKING FOR
- Significant cybersecurity experience (typically 10+ years) in security operations, incident response, threat detection, or cyber defense, including 5+ years leading teams
- Proven experience leading cybersecurity teams within a global technology or software environment, including distributed, multi-time-zone teams
- Demonstrated experience leading major incident response efforts from detection through recovery and post-incident review
- Strong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CK
- Hands-on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including evaluation and optimization
- Experience with threat hunting and detection engineering, including detection-as-code practices
- Strong understanding of AWS, Azure, or other modern cloud environments, including cloud-native logging, detection, and response
- Experience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirements
- Experience leveraging automation, scripting (e.g., Python), and ideally AI within security operations
- Experience managing budgets, vendors, and managed security service providers
- Strong leadership, analytical, and decision-making skills, particularly during high-pressure incidents
- Ability to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiences
- High integrity and sound judgment when handling sensitive, confidential, and privileged information
- Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP are a plus
WHO WE ARE
A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses.
Our corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.
OUR INTERVIEW PRACTICES
To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you-not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process.
Use of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.
Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.
The US pay range for this position is $170,000-$260,000. This range reflects the minimum and maximum total target annual compensation for this role across all U.S. locations. The actual compensation offered at the start of employment is determined based on factors including, but not limited to, experience level, knowledge, skills, and geographic location.
In addition to competitive compensation, this role includes a comprehensive benefits package featuring medical, dental, and vision coverage, flexible spending accounts (FSA), disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.