{"id":134716,"url":"https://alion.io/job/kldiscovery-director-cybersecurity-operations","title":"Director, Cybersecurity Operations","company":{"id":19512,"name":"KLDiscovery","domain":"kldiscovery.com","url":"https://alion.io/company/kldiscovery","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":86,"open_postings":4,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":6,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"head","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":175000,"max":215000,"currency":"USD","period":"year","gross":null,"usd_annual":215000},"salary_estimate":null,"experience_years_min":15,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CMMC","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-08-26T00:00:00Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-30T00:40:52Z","board_verified":true,"closed_at":null,"days_open":65,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":64},"description":"KLDiscovery is a leading global provider of best-in-class eDiscovery, information governance, and data recovery solutions, serving AmLaw 100 firms, Fortune 500 corporations, and government agencies. Our technology-enabled services and software help these law firms, corporations and agencies solve complex data challenges. Our Nebula and RelOne platforms deliver SaaS-based legal technology underpinned by managed services and professional services. The company, with offices in 26 locations across 17 countries helps clients with their litigation, regulatory compliance, internal investigation and data recovery and management needs all around the world.\nServing clients for over 30 years, KLDiscovery offers data collection and forensic investigation, early case assessment, electronic discovery and data processing, application software and data hosting for web-based document reviews, and managed document review services. In addition, through its global Ontrack Data Recovery business, KLDiscovery delivers world-class data recovery, email extraction and restoration, data destruction and tape management.\nKLDiscovery has been recognized as one of the fastest growing companies in North America by both Inc. Magazine (Inc. 5000) and Deloitte (Deloitte’s Technology Fast 500. Additionally, KLDiscovery is an Orange-level Relativity Best in Service Partner, a Relativity Premium Hosting Partner and Relativity’s 1st Service Provider partner, and maintains ISO/IEC 27001 Certified data centers.\nThe Director, Cybersecurity Operations leads Security Operations and Incident Response, Security Engineering, Vulnerability Management, and Threat Intelligence. This is a player-coach leadership role reporting directly to the CISO, partnering with the Director, Cyber GRC as one unified cyber team. The Director will bring hands-on technical depth, strong leadership capability, and the ability to modernize security operations through MDR deployment, AI-informed detection, and a security engineering team organized around functional specialization.\nThis is a fully remote position\nAt KLD we invest in employees and their families by placing their wellbeing first. We offer competitive total compensation that includes base pay, bonus potential, inclusive benefits, wellness programs, and perks. We use market and industry data to inform pay decisions while considering geography and labor markets, individual experience, and business needs. Individual compensation will vary, although a reasonable estimate of the current annualized base pay range for this position is $175,000 to $215,000.\nKey responsibilities\nSecurity operations and incident response\nOwn the MDR relationship, including SLA management, escalation accountability, detection tuning, and quarterly threat hunt reviews \nLead the incident response function: IR runbooks, major incident coordination, executive communication during active incidents, and post-incident root cause analysis \nOversee SOC detection engineering, ensuring SIEM rules, SOAR playbooks, and automated response actions are maintained, tested, and tuned to the current threat landscape \nDirect and develop the security analyst pool, redeploying analyst capacity from frontline triage toward MDR validation, threat hunt support, and stakeholder reporting \nSecurity engineering\nOversee four specialized engineering lanes [endpoint, identity, cloud, and application security], ensuring each lane has clear ownership, defined scope, and measurable outcomes \nDrive security architecture reviews and engineering decisions for large or complex IT projects, ensuring security requirements are built in rather than bolted on \nShape the security tooling stack strategy, evaluating, selecting, and retiring tools across endpoint, identity, cloud, and application security \nEnforce automation-first engineering practices, including IaC security gates, CI/CD pipeline security, CSPM auto-remediation, and SOAR-driven response workflows \nThreat intelligence, vulnerability management, and control validation\nLead the operationalization of threat intelligence, translating MDR findings and external threat data into detection rule updates, architecture decisions, and risk register inputs for the GRC team \nOwn the vulnerability management lifecycle: scanning coverage, risk-based prioritization, remediation tracking, and SLA enforcement \nOwn the purple team and control validation program, confirming that deployed controls operate as intended and that detection capabilities fire correctly against known attack techniques \nDrive threat modeling across the engineering function, identifying attack paths before they are exploited and feeding findings into remediation prioritization \nAppSec, cloud, and AI security\nOversee the AppSec function: secure SDLC, code review gates, SAST/DAST tooling, and security collaboration with the Product and Engineering teams \nOwn cloud security posture management: CSPM, cloud workload protection, cloud IAM governance, and cloud-native security architecture \nSet the team-wide AI security posture, overseeing AI security controls across all engineering lanes, including model security, prompt injection testing, and AI tool access governance in partnership with cyber leadership \nMDR, automation, and tooling modernization\nLead the ongoing maturation of the MDR deployment, expanding coverage, improving response fidelity, and integrating MDR outputs with internal SIEM, IAM, and compliance evidence workflows \nChampion security automation across the team, reducing manual toil in detection, response, vulnerability tracking, and reporting through SOAR, scripting, and platform integrations \nEvaluate emerging security technologies and make build/buy/partner recommendations to the CISO with clear business and risk rationale\nTeam leadership and CISO partnership\nLead, develop, and performance-manage a lean engineering team \nPartner with the Director, Cyber GRC as one unified cyber function, feeding operational threat intelligence into the risk register, supporting compliance evidence for technical controls, and jointly presenting security posture \nProvide regular metrics and reporting to the CISO on incident trends, control coverage, MDR performance, vulnerability posture, and team development \nBuild a team culture of continuous improvement, automation-first execution, and proactive security, where threat hunting and control validation are protected activities rather than aspirational ones\nQualifications\nExperience\n15+ years of progressive experience in information security, including at least 7 years in a security leadership role \nDemonstrated ownership of a security operations or engineering function at the Director or equivalent level \nExperience operating and maturing an MDR deployment (CrowdStrike Falcon Complete, Arctic Wolf, Expel, or equivalent) in a corporate environment \nHands-on background in at least two of the following: security engineering, penetration testing/offensive security, cloud security, application security, or incident response; this is not a purely strategic role \nDemonstrated experience deploying or maturing security automation, such as SOAR playbooks, detection engineering, IaC security, or CI/CD pipeline security \nFamiliarity with cloud-native security (AWS, Azure, or GCP), including CSPM, cloud IAM, and workload protection \nTechnical knowledge\nWorking knowledge of cybersecurity frameworks such as NIST SP 800-171, ISO 27001, and SOC 2 \nUnderstanding of the vulnerability management lifecycle: scanning, prioritization, remediation tracking, and SLA enforcement \nFamiliarity with AppSec disciplines: SAST/DAST tooling, secure SDLC, and security gate integration into CI/CD \nUnderstanding of IAM security governance (PAM, access review programs, and SSO/MFA architecture) as distinct from IT provisioning execution \nExperience with AI security considerations (model testing, prompt injection, AI tool access governance, and emerging AI governance frameworks such as the NIST AI RMF and ISO 42001) is a meaningful differentiator \nFoundational awareness of CMMC requirements \nGeneral abilities\nAn exceptional communicator, able to translate complex cyber risk and compliance concepts into clear business language for executives, clients, and regulators alike \nA natural collaborator and client-facing presence, comfortable leading enterprise client security discussions, representing KLDiscovery in due diligence meetings, and building trust with external stakeholders \nBusiness-minded, balancing security requirements against commercial realities and making practical decisions without sacrificing rigor \nA continuous learner with genuine curiosity, energized by a fast-growing company and a rapidly evolving regulatory and threat landscape \nDiscreet and trusted, exercising sound judgment, maintaining confidentiality, and operating with professionalism \nEducation\nBachelor's degree in Information Security, Computer Science, Engineering, Business, or a related field required \nProfessional certifications such as CISSP, CISM, CISA, GPEN, GCIA, or other GIAC certifications strongly preferred \nMaster's degree or MBA with a security focus preferred \nOur mission and core values\nOur Mission: We bring clarity, trust, and meaning to data for clients navigating legal matters worldwide.\nClient is Always in the Room - We operate and make decisions as if the client is in the room. We anticipate their needs, consider their perspective, and prioritize their best interests.\nOwn the Outcome - We bring an unwavering bias for action, act with urgency, and hold ourselves accountable to our clients, and each other.\nBetter Every Day - We improve our tomorrow by always striving to be better than today. We embrace curiosity, question assumptions, and raise the bar constantly.\nDeliver Results Together - We collaborate obsessively to achieve shared success. We assume good intentions, debate ideas thoughtfully, treat each other with respect, and fully commit once decisions are made.\n\nOur culture shapes our actions, our products, and the relationships we forge with our customers.\nAt KLD, our people are at the heart of everything we do. We believe that when our employees feel supported, valued, and empowered, they can thrive both personally and professionally. That’s why we’re committed to fostering a collaborative, inclusive workplace where you can grow your career, make meaningful contributions, and enjoy a healthy work-life balance.\nOur competitive benefits and programs are designed to support your well-being and success. Depending on your location, these may include comprehensive health and wellness benefits, retirement and financial programs, paid time off and leave options, employee assistance resources, and professional development opportunities.\nWe also embrace flexibility, offering remote work opportunities for most employees to support work-life balance while keeping our teams connected and collaborative. Certain roles may require an office-based or hybrid schedule based on business and operational needs.\nWherever you’re located, you’ll be part of a global team that values your contributions, supports your growth, and celebrates your success.\nBenefits and eligibility vary by country, location, employment status, and applicable plan or program requirements.","description_format":"text","description_chars":11302,"description_truncated":false,"requirements":{"experience_years_min":15,"management_years_min":7,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Professional development","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Document Management","Backup & Disaster Recovery"],"lifecycle":[{"event":"open","at":"2026-08-26T00:00:00Z"},{"event":"close","at":"2026-09-23T14:57:59Z"},{"event":"reopen","at":"2026-10-23T17:37:59Z"}],"visa":[],"liveness":{"score":10,"band":"cold","label":"Long shot","p_open":1,"p_active":0.29,"p_room":0.35,"age_days":65,"expected_fill_days":6,"reasons":["conf:5","win:tail"],"computed_at":"2026-10-30T05:48:23Z"},"pay":{"stated_usd_annual":215000,"is_top_pay":true},"html_url":"https://alion.io/job/kldiscovery-director-cybersecurity-operations","json_url":"https://alion.io/job/kldiscovery-director-cybersecurity-operations.json","meta":{"generated_at":"2026-10-30T13:27:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":420,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":19512},"rest":"https://alion.io/mcp/rest/get_company?id=19512"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkldiscovery-director-cybersecurity-operations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkldiscovery-director-cybersecurity-operations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkldiscovery-director-cybersecurity-operations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kldiscovery-director-cybersecurity-operations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkldiscovery-director-cybersecurity-operations"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":134716}},{"tool":"search_jobs","arguments":{"company":"kldiscovery.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":134716},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}