• Supervise and govern the development of analytics in Splunk (SPL) or Elastic Search (EQL) to detect actionable security alerts • Develop and fine-tune advanced detection rules, alerting mechanisms, and use cases to identify and respond to sophisticated security threats • Create comprehensive security metrics, reports, dashboards, providing detailed insights into the organization's security posture • Ensure that the SIEM solution complies with global regulatory standards and industry best practices • Mentor and guide SIEM engineers, fostering a culture of continuous learning and development within the team • Participate in the development of the organization's security strategy and contribute to its execution • Monitor and support SIEM platforms to ensure security and stability of SOC infrastructure • Provide day-to-day leadership and oversight for the SIEM engineering team, ensuring alignment with strategic goals and operational priorities • Facilitate regular team standups, retrospectives, and planning sessions to promote transparency and accountability • Coach team members on technical and professional growth, offering constructive feedback and career development support • Champion a collaborative and inclusive team culture that encourages innovation, ownership, and continuous improvement • Identify and address skill gaps through targeted training, mentoring, and knowledge-sharing initiatives • Act as a point of escalation for technical challenges and team dynamics, resolving issues with empathy and decisiveness • Collaborate with cross-functional teams to ensure seamless integration of SIEM capabilities into broader cyber response workflows

• Monitor, analyze, and detect cyber events and incidents • Assist with cyber defense initiatives and maintain security toolsets • Develop security assessment plans outlining objectives, scope, schedule, risks • Conduct ad hoc security testing to support development activities and vulnerability remediation • Review and test system security controls for compliance with federal requirements

Cleo is seeking a Security Operations Lead to build, operate, and continuously improve our security detection, response, and operational resilience capabilities. This leader will be responsible for protecting Cleo's cloud infrastructure, SaaS platforms, endpoints, and corporate environment from evolving threats while ensuring operational stability and regulatory alignment. The ideal candidate is hands-on, technically deep, and capable of building scalable security operations in a high-growth SaaS environment. What You Will Be Doing Security Monitoring and Detection - Own and evolve Cleo's detection and response strategy - Lead daily monitoring of security events across cloud, endpoint, identity, and application layers - Continuously tune detection rules to reduce noise and improve signal - Ensure effective coverage across AWS, SaaS platforms, and corporate systems - Leverage SIEM, EDR, and cloud-native tooling to improve visibility Incident Response and Containment - Lead security incident investigations and coordinate cross-functional response - Develop and maintain incident response playbooks - Conduct post-incident reviews focused on systemic improvement - Reduce mean time to detect and contain security events - Partner with Legal, Compliance, and Leadership during material incidents Vulnerability and Exposure Management - Oversee vulnerability scanning across infrastructure, endpoints, and cloud resources - Prioritize remediation based on business risk - Track critical vulnerability exposure windows - Partner with Engineering and IT to drive timely remediation Cloud and Identity Security Operations - Monitor and secure AWS accounts and cloud-native services - Identify and remediate misconfigurations - Strengthen identity and access management controls - Collaborate with Cloud Security and Platform teams on guardrails Operational Metrics and Reporting - Define and track security operations KPIs - Report on detection efficacy, remediation timelines, and exposure trends - Provide board-ready operational risk metrics - Support audit and compliance evidence requirements Automation and Continuous Improvement - Automate repetitive operational tasks - Improve alert triage workflows - Optimize tooling effectiveness and cost efficiency - Reduce operational friction through process refinement Leadership and Collaboration - Lead and mentor security analysts and engineers - Partner closely with Engineering, IT, and Platform teams - Contribute to the Security Champion and Guild initiatives - Build a culture of proactive risk identification Your Skills - Experience in mid-market or high-growth SaaS environments - Experience supporting SOC 2, ISO 27001, or similar audits - Familiarity with MITRE ATT&CK framework - Experience building or maturing security operations functions - Relevant certifications such as CISSP, GCIA, GCIH, or similar Your Qualifications Education - Bachelor's degree required. Experience - 7+ years of experience in security operations, incident response, or detection engineering - Strong experience securing cloud-native SaaS environments, preferably AWS - Hands-on experience with SIEM, EDR, vulnerability management, and cloud security tooling - Deep understanding of attacker techniques and threat detection methodologies - Experience leading incident response efforts - Strong communication skills with the ability to translate technical risk into business impact A few things we have to offer: - Compensation: $120,000 - $140,000 - Great Healthcare + Dental + Vision - Flexible PTO - Culture of support, encouraging Life-Work balance - 401k match - FSA and HSA options - Employee Assistance Program - Paid Parental Leave - Representing a company with 4,000+ clients and a 99% retention rate - Accelerated title and salary growth potential - A fun and energetic work environment that makes you excited to go to work every day

• Own end-to-end security operations including SOC, monitoring, and detection capabilities • Oversee SIEM, EDR, and logging programs to ensure effective threat detection and response • Manage internal and third-party security operations providers (e.g., MSSP) • Continuously improve alert quality, detection coverage, and operational efficiency • Act as technology incident commander for security events and incidents • Lead operational response including triage, containment, eradication, and recovery • Ensure incidents are managed in accordance with established procedures and SLAs • Escalate critical and high-risk incidents to the CISO with clear analysis and recommendations • Lead post-incident reviews and drive continuous improvement actions • Own the operational lifecycle of vulnerability management including scanning, prioritization, and remediation tracking • Ensure adherence to defined remediation timelines and SLAs • Coordinate penetration testing activities and validation of remediation efforts • Provide visibility into vulnerability risk and remediation progress • Oversee logging and monitoring programs to ensure comprehensive visibility across the environment • Drive development and tuning of detection use cases and alert logic • Ensure effective integration of threat intelligence into detection and response processes • Oversee operational response to phishing and email-based threats • Ensure timely triage, analysis, and mitigation of reported phishing activity • Partner with the Manager, Information Security on phishing trends and control improvements • Ensure security controls are operating effectively across monitoring, incident response, vulnerability management, and access enforcement • Identify control gaps, breakdowns, or inefficiencies and drive remediation • Escalate systemic control issues and risks to the CISO and Technology Risk • Develop and maintain operational metrics and KPIs (e.g., MTTR, vulnerability SLAs, alert volumes) • Provide regular reporting on security operations performance and risk trends • Identify opportunities to improve automation, tooling, and processes • Lead and mentor security operations personnel • Partner with Infrastructure, Engineering, DevSecOps, and Technology teams to implement and improve controls • Support audits, regulatory assessments, and evidence requests related to security operations