Manager, Security Operations & Incident Response
Confirmed on the employer's own hiring board on Nov 3, 2026. First seen by Alion on Nov 2, 2026.
About Us:
At Sitecore, our mission is to simplify how brands reach, engage, and serve people by delivering intelligent, personalised digital experiences that connect the world. We empower the world’s most iconic brands to build lifelong relationships with their customers-seamlessly, smartly, and at scale.
As the leading provider of agentic digital experience software, Sitecore brings together content, commerce, and data into one composable platform that enables brands to deliver millions of meaningful, adaptive experiences every day. Trusted by global leaders such as American Express, Porsche, Starbucks, and L’Oréal, Sitecore helps brands transform engagement through experiences that are not only personalised but predictive and dynamic.
Our foundation is our people-a diverse, passionate, and collaborative global team spanning over 25 countries. We believe that every experience matters, and that belief starts with how we work together. Our values guide how we lead, innovate, and connect. They are the behaviours that bring our mission and vision to life, every day, in every interaction.
As we continue to evolve, we are actively cultivating AI skills across our teams to unlock new levels of creativity, efficiency, and insight. From engineering to customer experience, AI capabilities are becoming integral to how we design, build, and deliver the next generation of digital experiences.
Learn more at Sitecore.com.
About the Role:
The Manager, Security Operations & Incident Response is responsible for leading Sitecore's Security Operations Center (SOC) and Incident Response (IR) functions. This role oversees daily security monitoring, detection, triage, investigation, containment, and response activities while ensuring effective collaboration with external security service providers and internal stakeholders.
You will drive the evolution of Sitecore's security operations capabilities toward an AI-assisted and automation-enabled operating model, leveraging machine learning, generative AI, autonomous workflows, and security orchestration technologies to improve detection quality, response speed, and operational efficiency. The role is accountable for establishing a modern, cloud-native SOC capable of supporting Sitecore's global SaaS business and for continuously improving the organization's cyber defense posture.
What You'll Do
Security Operations Leadership
Lead the day-to-day operations of the SOC and Incident Response function
Manage security monitoring, alert triage, investigation, escalation, containment, recovery, and post-incident analysis activities
Establish operational priorities, procedures, playbooks, metrics, and service levels
Ensure effective coverage across cloud, endpoint, identity, SaaS, and application environments
Maintain operational readiness for emerging threats, significant vulnerabilities, and security incidents
MSSP Management
Serve as the primary operational interface with Sitecore's Managed Security Service Provider (MSSP)
Define, monitor, and improve MSSP performance expectations and service levels
Review alert quality, escalation practices, investigation outcomes, and operational effectiveness
Drive continuous tuning and optimization of security monitoring capabilities
Ensure MSSP services align with Sitecore's security strategy and risk priorities
Incident Response
Lead cyber incident response activities and coordinate technical response efforts
Act as Incident Commander or designate response leadership during security incidents
Coordinate activities across Security, Engineering, Infrastructure, Product, Legal, Privacy, Communications, and other stakeholders as required
Ensure appropriate evidence collection, documentation, lessons learned, and corrective actions
Maintain incident response playbooks, procedures, and readiness exercises
Threat Detection & Monitoring
Own the effectiveness of security detections across all monitoring platforms
Drive improvement of detection coverage for identity, cloud, endpoint, SaaS, infrastructure, and application threats
Review and prioritize alerts from platforms including Wiz, Microsoft security technologies, cloud security tooling, and third-party detection sources
Partner with Security Engineering to implement and improve detection logic, workflows, and response automation
Vulnerability and Exposure Response
Own operational response processes for critical security findings and emerging threats
Coordinate investigation and response activities associated with Wiz findings, attack path analysis, and high-priority vulnerabilities
Support 0-day, KEV, and active exploitation response activities
Provide operational visibility into remediation progress and risk reduction activities
AI-Assisted Security Operations
Develop and execute the roadmap for an AI-assisted SOC
Identify opportunities to leverage AI for alert enrichment, investigation support, threat analysis, detection engineering, reporting, and operational efficiency.
Establish governance, controls, and oversight for AI-enabled security operations
Drive adoption of approved autonomous response capabilities where operationally appropriate
Lead the implementation of AI-assisted and autonomous containment actions for approved scenarios while ensuring appropriate human oversight, testing, and governance
Continuous Improvement & Metrics
Define and track SOC and IR performance metrics
Measure detection effectiveness, response effectiveness, automation adoption, containment speed, incident trends, and MSSP performance
Identify operational improvement opportunities and drive execution
Produce executive-ready operational reporting and status updates
Team Leadership
Recruit, develop, mentor, and lead security operations personnel
Establish clear accountability, performance expectations, and development plans
Build a high-performing operational security culture focused on continuous improvement and measurable outcomes
Foster strong collaboration across Security, Engineering, IT, Product, and Operations teams
What You'll Bring
SOC and Incident Response Leadership: Proven experience managing a Security Operations Center (SOC) and Incident Response (IR) function, including security monitoring, alert triage, threat investigation, containment, recovery, and post-incident reviews in a 24/7 environment
Cloud-Native Security Operations: Strong hands-on experience securing and monitoring cloud environments (AWS, Azure, or GCP), SaaS platforms, endpoints, identities, infrastructure, and applications within a global technology or SaaS organization
Major Incident and Crisis Management: Demonstrated experience leading complex security incidents as Incident Commander, coordinating technical response and cross-functional stakeholders, and managing evidence collection, incident communications, and remediation activities
MSSP and Security Tooling Management: Experience managing external MSSPs, defining SLAs and operational KPIs, evaluating service quality, and optimizing security monitoring and detection platforms such as Wiz and Microsoft security technologies (e.g., Sentinel, Defender)
Threat Detection, Vulnerability and Response Automation: Strong understanding of threat detection engineering, SIEM/SOAR, vulnerability and exposure management, threat intelligence, and response to critical vulnerabilities, zero-day exploits, KEVs, and active threats.
AI-Driven Security Operations and Automation: Demonstrated experience implementing or advancing AI-assisted security operations, leveraging machine learning, generative AI, automation, or autonomous workflows for alert enrichment, investigation, detection, and response, with appropriate governance and human oversight.
Why Join Sitecore?
At Sitecore, you will have the opportunity to shape the experiences behind digital products used by organizations around the world. You will work with talented colleagues across Product, Engineering, and Design to solve meaningful customer problems, influence product strategy, and help define the next generation of digital experiences.
Equal Opportunities at Sitecore:
Sitecore is proud to be an equal opportunity workplace. We are committed to equal employment opportunity without unlawful regard to race, color, ancestry, religion, gender, national origin, sexual orientation, age, citizenship, marital status, disability, veteran status, or any other locally legally protected characteristic.