Operations Advisor, Cyber Defense Operations

Role Summary

The Operations Advisor is the primary technical owner of detection outcomes for assigned clients. You improve detection quality, identify gaps in coverage, and advance client security maturity through expert-level advisory and hands-on detection engineering. You lead the technical account relationship, and you deliver measurable outcomes that clients can see and trust. This role reports to Manager, Cyber Defense Operations

Responsibilities

• Own and maintain detection coverage aligned to the Cyderes Rule Set
• Lead tuning and optimization of detection rules across SIEM platforms
• Identify, prioritize, and remediate detection gaps
• Be a trusted advisor on detection strategy and operational effectiveness
• Identify detection improvements based on real-world incident insights
• Partner with SOC and DFIR teams during escalations
• Oversee the technical account relationship for assigned clients
• Lead technical cadence calls focused on detection performance, gaps, and outcomes
• Translate technical findings into risk-based, business-relevant insights
• Guide clients on prioritization of improvements based on detection impact
• Be a trusted advisor on detection strategy and operational effectiveness

Requirements

• 3-5 years of experience in detection engineering, security operations, or a related discipline
• Hands-on proficiency with one or more enterprise SIEM platforms (Splunk, Microsoft Sentinel, Chronicle, or equivalent)
• Demonstrated experience writing and tuning detection rules in production environments
• Experience in a managed security services or MSSP environment serving multiple clients
• Proficiency in multiple SIEM query languages (SPL, KQL, YARA-L, or similar)
• Familiarity with SOAR platforms and automation-assisted detection workflows
• Experience with threat hunting methodologies and retrohunt program execution
• Relevant certifications: GCIA, GCIH, GCDA, or SIEM vendor certifications