Director, Ransomware Detect & Respond

What we do:
Halcyon is the industry’s first dedicated, adaptive security platform that combines multiple proprietary advanced prevention engines along with AI models focused specifically on stopping ransomware.

Who we are:
Halcyon was formed in 2021 by a team of cyber industry veterans after battling the scourge of ransomware (and advanced threats) for years at some of the largest global security vendors. Comprised of leaders from Cylance (now Blackberry), Accuvant (now Optiv), Fireye and ISS X-Force (now IBM), Halcyon is focused on building products and solutions for mid-market and enterprise customers.

As a remote-native, completely distributed global team, we recognize great talent can exist anywhere. We invite you to apply to a job you’re interested in and we'll work a plan to meet your needs.

The Role:
Halcyon is seeking an experienced Director, Ransomware Detect & Respond (RDR) to build, lead, and manage our 24/7/365 Security Operations Center. You will own all aspects of continuous monitoring of our anti-ransomware platform, ensuring real-time visibility into ransomware threats and guiding customers through detection and mitigation. This role requires a strategic thinker who can establish scalable processes, build a high-performing team of SOC analysts, and collaborate closely with product, engineering, and support functions to keep customers safe.

Responsibilities:

• SOC Strategy & Operations

  • Architect and implement a world-class, round-the-clock operations center focused exclusively on ransomware monitoring, detection, and customer support.

  • Develop and maintain standard operating procedures (SOPs), runbooks, and escalation playbooks that ensure consistent, high-quality triage of alerts and customer engagements.

  • Define and track key performance indicators (SLAs, MTTR, detection coverage, alert accuracy) to measure SOC effectiveness and drive continuous improvement.

• Team Leadership & Development

  • Recruit, mentor, and manage a team of SOC analysts—creating clear career paths, training programs, and certification goals.

  • Foster a culture of accountability, collaboration, and continuous learning within the RDR team, ensuring analysts understand evolving ransomware tactics and our product’s telemetry.

  • Conduct regular exercises (e.g., tabletop drills, alert-handling simulations) to validate readiness and refine processes.

• Detection Engineering Coordination

  • Partner with RISE (Research, Intelligence, Services, Engineering) to ensure that the latest threat intelligence and telemetry are integrated into our monitoring platform.

  • Work closely with Product and Engineering to validate that endpoint, cloud, and network telemetry feed into the SOC’s analytics system and that alert thresholds are appropriately tuned.

  • Collaborate with domain experts to translate new ransomware trends into actionable alert rules and automated workflows.

• Customer Monitoring & Support

  • Oversee real-time monitoring of customer environments—identifying suspicious activity and guiding customers through initial investigation steps.

  • Serve as the primary escalation point for high-severity customer alerts: coordinate with Support, Engineering, and RISE to advise on containment, remediation, and recovery actions.

  • Maintain a customer-facing incident log that captures timelines, root-cause analyses, and lessons learned—feeding insights back to Product for feature improvements.

• Risk Management & Compliance

  • Ensure SOC processes align with relevant security frameworks (NIST CSF, ISO 27001) and support customer compliance needs.

  • Coordinate periodic reviews of detection controls (e.g., tuning alert thresholds, reviewing false-positive/false-negative rates) to maintain optimal coverage.

  • Manage relationships with external vendors for threat intelligence feeds, monitoring tools, and log aggregation services.
    
    

Skills and Qualifications:

• 8+ years of hands-on experience in SOC leadership, security monitoring, or managed detection operations—ideally within a cybersecurity product organization.

• Demonstrated track record of building and scaling a 24/7/365 SOC, including staffing, process design, and performance measurement.

• Deep understanding of ransomware threat actor TTPs, attack chains, and typical enterprise telemetry (endpoint, network, cloud).

• Proven ability to translate threat intelligence into effective monitoring rules, dashboards, and alerting strategies.

• Strong leadership and people-management skills: coaching analysts, driving accountability, and fostering collaboration under pressure.

• Excellent written and verbal communication skills—able to convey technical findings and operational metrics to executives, product teams, and customers.

• High emotional intelligence, with a calm, decisive demeanor during high-stress situations.

• Proficiency with SIEM/analytics platforms (e.g., Splunk, Elastic, QRadar), log aggregation tools, and incident-tracking systems.

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
  
  

Bonus Skills and Qualifications:

• Prior experience working in or leading a SOC at a security-focused product company.

• Certifications such as CISSP, GCIH, or equivalent GIAC credentials.

• Familiarity with SOAR or automation platforms to streamline alert handling and triage workflows.

• Hands-on understanding of cloud security monitoring (AWS CloudWatch, Azure Sentinel, GCP Security Command Center).

• Demonstrated success developing and presenting SOC performance reports and post-incident analyses to leadership or customers.
  
  

In accordance with applicable state and federal laws, the range provided is Halcyon’s reasonable estimate of the base compensation for this role. The actual amount may differ based on non-discriminatory factors such as experience, knowledge, skills, abilities, and location. Base pay is one part of the total package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and equity in the Company.

We understand it takes a diverse team of highly intelligent, passionate, curious, and creative people to develop the exceptional product we are building. Our dynamic team has incredible perspectives to share, just as we know you do, and we take great pride in being an equal opportunity employer.