{"id":52663,"url":"https://alion.io/job/coindesk-manager-sr-manager-secops-cyber-defense","title":"Manager / Sr. Manager, SecOps & Cyber Defense","company":{"id":12354,"name":"CoinDesk","domain":"coindesk.com","url":"https://alion.io/company/coindesk","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":126000,"max_usd":241000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"Incident Management","optional":false},{"name":"Kubernetes","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"ISO 27001","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-08-10T00:00:00Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-01T13:40:21Z","board_verified":true,"closed_at":null,"days_open":83,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":83},"description":"CoinDesk is the most trusted media, events, indices and data company for the global crypto economy. Since 2013, CoinDesk Media has led the story of the future of money and investing, illuminating the transformation in society and culture that comes with it. Our award-winning team of journalists delivers news and unparalleled insights that bring transparency, comprehension and context. CoinDesk Events gathers the global crypto, blockchain and Web3 communities at annual events such as Consensus, the world’s largest and longest-running crypto festival. CoinDesk Indices offers expertise in digital asset indices, data and research to educate and empower investors. For more information on CoinDesk media and events, please visithttp://coindesk.com [coindesk.com] and for breaking headlines, data and indices visithttp://coindeskmarkets.com[coindeskmarkets.com]\nIn November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. For more information on Bullish, please visit https://bullish.com . CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence.\nReports to:\nHead of Security EngineeringPosition Overview\nWe are seeking an experienced, hands-on Manager / Sr. Manager of SecOps & Cyber Defense to lead, scale, and actively drive our 24/7 security detection and response capabilities in the US, UK, & EMEA.\nIn this dual-capability role, you will lead a lean, highly technical group of SOC analysts and incident responders while remaining deeply connected to the engineering work. You will sit in the hot seat during major incidents, build high-efficacy detection engineering pipelines across cloud and hybrid infrastructure, and continuously elevate our threat hunting and triage posture.\nThis role is based in NYC and will be required to work onsite at our office located in Chelsea a minimum of 4 days per week. The position reports to the Head of Security Engineering.\nResponsibilities:\nLeadership & Team Operations\nManage & Mentor: Lead and mentor a small, high-performing team of SOC Analysts and Incident Response engineers across multiple time zones.\n\nOn-Call & Escalations: Serve as the primary point of escalation for high-severity security incidents, managing the global operational shift structure and continuous coverage model.\n\nMetrics & Maturity: Define and track key SOC operational metrics (MTTD, MTTR, false positive ratios, incident coverage against MITRE ATT&CK) to drive continuous improvement.\n\nCross-Functional Collaboration: Partner closely with Infrastructure, Cloud Platform, DevOps, Corporate IT, Legal, and Compliance teams during critical triage and investigation phases.\n\nTechnical Execution & Incident Response\nIncident Management: Drive end-to-end response for major security incidents-from initial detection, containment, and eradication to root-cause analysis and post-mortem reporting.\n\nDetection Engineering: Design, write, and tune high-precision detection rules (SIEM, EDR, Cloud-native logs) to minimize noise and highlight sophisticated threat activity.\n\nForensics & Triage: Perform hands-on digital forensics (memory, disk, network artifact analysis) and reverse-engineer suspicious scripts/payloads when necessary.\n\nThreat Research & Readiness: Conduct targeted research into emerging threat actor TTPs, zero-days, and cloud vulnerabilities to preemptively fortify detection capabilities and response playbooks.\n\nAdversarial Testing & Exercises: Lead and participate in regular Red/Purple team operations and executive tabletop exercises to stress-test incident response readiness and validate control coverage.\n\nThreat Hunting: Proactively hunt for undetected threat actor behavior using internal logs, intelligence feeds, and custom queries.\n\nSOAR & Automation: Build and refine automated response playbooks using Python, API integrations, and SOAR tools to streamline repetitive analyst workflows.\n\nExperience & Qualifications:\n8+ years of dedicated, hands-on experience in SOC operations, threat detection, and security incident response.\n\n2+ years of direct people management or formal team leadership experience, preferably overseeing a geographically distributed workforce.\n\nDeep operational expertise in investigating cloud-native threats (AWS, GCP, or Azure), container environments (Kubernetes, Docker), and modern SaaS infrastructure.\n\nAdvanced proficiency with modern SIEM platforms, EDR/XDR suites, log aggregators, and SOAR tools.\n\nStrong scripting and automation skills in Python, Bash, or Go to automate triage tasks and query APIs.\n\nStrong knowledge of network protocols, cloud architecture, identity systems (Okta, Azure AD), and digital forensics fundamentals.\n\nProven ability to stay calm, decisive, and communicative under pressure during high-severity security incidents.\n\nNice-to-Have:\nPrior experience in Financial Services, FinTech, Digital Assets, or high-throughput trading environments operating under strict regulatory audit standards (SOC 2, ISO 27001, SEC/FINRA frameworks).\n\nRelevant industry certifications such as GIAC (GCIH, GCFA, GNFA, GCDA), CISSP, or OSCP.\n\nBullish US LLC & CoinDesk Inc. are committed to offering competitive compensation and benefits. The anticipated base salary for this position is $185,000- $235,000 + discretionary annual target bonus + performance incentives/benefits. Offered salary will be reflective of job related knowledge, skills and commensurate experience.\nEQUAL OPPORTUNITY\nIn an effort to attract, retain, develop and promote the most qualified individuals, CoinDesk is committed to treating all applicants and employees in a nondiscriminatory manner with respect to the terms and conditions of employment, without regard to race, color, religion or belief, sex, national or ethnic origin, ancestry, age, marital status, sexual orientation, gender identity, veteran status/service, physical or mental disability, or any other classification protected by applicable law. This mandate governs all aspects of employment, including recruitment, selection, promotion, training, education, social and recreation programs, compensation, discipline, termination and access to benefits.\nACCOMMODATION\nCoinDesk is also committed to providing reasonable accommodations to individuals with disabilities. If you need a reasonable accommodation because of a disability for any part of the application process, please send an e-mail to  and let us know the nature of your request.","description_format":"text","description_chars":6515,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Blockchain & Crypto","Financial Data & Market Intelligence"],"lifecycle":[{"event":"open","at":"2026-08-10T00:00:00Z"},{"event":"close","at":"2026-10-29T13:32:18Z"},{"event":"reopen","at":"2026-10-30T20:00:57Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":0,"green_card_filings_12m":1,"median_offered_wage_usd":82500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":47,"band":"ok","label":"Likely open","p_open":1,"p_active":0.791,"p_room":0.6,"age_days":83,"expected_fill_days":87,"reasons":["conf:3","win:late","crowd:"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/coindesk-manager-sr-manager-secops-cyber-defense","json_url":"https://alion.io/job/coindesk-manager-sr-manager-secops-cyber-defense.json","meta":{"generated_at":"2026-11-01T14:01:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21598,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":12354},"rest":"https://alion.io/mcp/rest/get_company?id=12354"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcoindesk-manager-sr-manager-secops-cyber-defense"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcoindesk-manager-sr-manager-secops-cyber-defense"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcoindesk-manager-sr-manager-secops-cyber-defense"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/coindesk-manager-sr-manager-secops-cyber-defense\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcoindesk-manager-sr-manager-secops-cyber-defense"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":52663}},{"tool":"search_jobs","arguments":{"company":"coindesk.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":52663},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}