Director, Ransomware Detect & Respond

The Role:
Halcyon is seeking an experienced Director, Ransomware Detect & Respond (RDR) to build, lead, and manage our 247365 Security Operations Center. You will own all aspects of continuous monitoring of our antiransomware platform, ensuring realtime visibility into ransomware threats and guiding customers through detection and mitigation. This role requires a strategic thinker who can establish scalable processes, build a highperforming team of SOC analysts, and collaborate closely with product, engineering, and support functions to keep customers safe.

Responsibilities:

• SOC Strategy & Operations

  • Architect and implement a worldclass, roundtheclock operations center focused exclusively on ransomware monitoring, detection, and customer support.

  • Develop and maintain standard operating procedures (SOPs), runbooks, and escalation playbooks that ensure consistent, highquality triage of alerts and customer engagements.

  • Define and track key performance indicators (SLAs, MTTR, detection coverage, alert accuracy) to measure SOC effectiveness and drive continuous improvement.

  • • Team Leadership & Development

      • Recruit, mentor, and manage a team of SOC analysts—creating clear career paths, training programs, and certification goals.

      • Foster a culture of accountability, collaboration, and continuous learning within the RDR team, ensuring analysts understand evolving ransomware tactics and our product’s telemetry.

      • Conduct regular exercises (e.g., tabletop drills, alerthandling simulations) to validate readiness and refine processes.

      • • Detection Engineering Coordination

          • Partner with RISE (Research, Intelligence, Services, Engineering) to ensure that the latest threat intelligence and telemetry are integrated into our monitoring platform.

          • Work closely with Product and Engineering to validate that endpoint, cloud, and network telemetry feed into the SOC’s analytics system and that alert thresholds are appropriately tuned.

          • Collaborate with domain experts to translate new ransomware trends into actionable alert rules and automated workflows.

          • • Customer Monitoring & Support

              • Oversee realtime monitoring of customer environments—identifying suspicious activity and guiding customers through initial investigation steps.

              • Serve as the primary escalation point for highseverity customer alerts: coordinate with Support, Engineering, and RISE to advise on containment, remediation, and recovery actions.

              • Maintain a customerfacing incident log that captures timelines, rootcause analyses, and lessons learned—feeding insights back to Product for feature improvements.

              • • Risk Management & Compliance

                  • Ensure SOC processes align with relevant security frameworks (NIST CSF, ISO 27001) and support customer compliance needs.

                  • Coordinate periodic reviews of detection controls (e.g., tuning alert thresholds, reviewing falsepositivefalsenegative rates) to maintain optimal coverage.

                  • Manage relationships with external vendors for threat intelligence feeds, monitoring tools, and log aggregation services.
                    
                    

                  • • Skills and Qualifications:

                      • 8+ years of handson experience in SOC leadership, security monitoring, or managed detection operations—ideally within a cybersecurity product organization.

                      • Demonstrated track record of building and scaling a 247365 SOC, including staffing, process design, and performance measurement.

                      • Deep understanding of ransomware threat actor TTPs, attack chains, and typical enterprise telemetry (endpoint, network, cloud).

                      • Proven ability to translate threat intelligence into effective monitoring rules, dashboards, and alerting strategies.

                      • Strong leadership and peoplemanagement skills: coaching analysts, driving accountability, and fostering collaboration under pressure.

                      • Excellent written and verbal communication skills—able to convey technical findings and operational metrics to executives, product teams, and customers.

                      • High emotional intelligence, with a calm, decisive demeanor during highstress situations.

                      • Proficiency with SIEManalytics platforms (e.g., Splunk, Elastic, QRadar), log aggregation tools, and incidenttracking systems.

                      • Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
                        
                        

                      • Bonus Skills and Qualifications:

                        • Prior experience working in or leading a SOC at a securityfocused product company.

                        • Certifications such as CISSP, GCIH, or equivalent GIAC credentials.

                        • Familiarity with SOAR or automation platforms to streamline alert handling and triage workflows.

                        • Handson understanding of cloud security monitoring (AWS CloudWatch, Azure Sentinel, GCP Security Command Center).

                        • Demonstrated success developing and presenting SOC performance reports and postincident analyses to leadership or customers.
                          
                          

                        • Benefits:

                          Halcyon offers the following benefits to eligible employees:

                          • Comprehensive healthcare (medical, dental, and vision) with premiums paid in full for employees and dependents.

                          • 401k plan with a generous employer contribution.

                          • Short and longterm disability coverage, basic life and AD&D insurance plans.

                          • Medical and dependent care FSA options.

                          • Flexible PTO policy.

                          • Parental leave.

                          • Generous equity offering.

                          • The Company reserves the right to modify or change these benefits programs at any time, with or without notice.​
                            
                            

                            Base Salary Range: $150,000 $180,000

                            In accordance with applicable state and federal laws, the range provided is Halcyon’s reasonable estimate of the base compensation for this role. The actual amount may differ based on nondiscriminatory factors such as experience, knowledge, skills, abilities, and location. Base pay is one part of the total package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonusesincentives, and equity in the Company.

                            We understand it takes a diverse team of highly intelligent, passionate, curious, and creative people to develop the exceptional product we are building. Our dynamic team has incredible perspectives to share, just as we know you do, and we take great pride in being an equal opportunity employer.