• Direct the functions, processes, and operations of the security operations team SOC and ensure policies and procedures are followed. • Lead the security operations team to ensure optimal identification / resolution of security incidents and enhance security. • Ensure SLA compliances, process adherence, process improvement to meet operational objectives. • Manage the collection, documentation and research of security incidents and investigations. • Provide Senior Management with a realistic overview of risks and threats in the Marqeta environment. • Continuous development and maintenance of the incident response management program which includes incident detection, analysis, containment, eradication, recovery and chain of evidence / forensic artifacts. • Ability to work directly with all levels of Marqeta employees (Executive, Senior management, SMEs.) • Create and maintain reports, dashboards, and metrics of security operations for regular reporting and presentation to management. • Manage the process improvement program for security operations processes. • Conduct scheduled and ad hoc training exercises to ensure staff are current with the latest threats and incident response techniques. • Provide direction, leadership and management of security operations personnel. • Create a high-performing team culture where team members are supported, standards are consistently upheld, people are treated with respect, and everyone feels a sense of belonging. • Manage cross-functional response with Fraud and Risk for cyberfraud activities • Lead best practices for detection engineering lifecycles collaboratively with the detection engineering team, ensuring high quality metrics around alert quality and optimization • Lead development of security playbooks for incident response and collaborate on security automation strategy with detection engineering • Develop and maintain modern threat intelligence program • Leverage modern AI/ML tools as a force multiplier

• Serve as a primary responder for AFC customer systems, taking ownership of client configuration issues and tracking through resolution. • Act as a point of escalation for junior level Engineers and provide guidance and mentoring. • Advise best practice on SIEM/MDR/SOAR products to both technical and relatively non-technical personnel. • Provide remote consulting services via interactive client sessions to assist with implementation of multiple product vendors and technologies. • Implement and configure SIEM/MDR/SOAR software and appliance-based products in large enterprise and Government environments. • Develop and maintain security content and reporting. • Perform knowledge transfers to clients regarding security and system configuration awareness.

• Monitor Delinea security platforms to identify, investigate, and respond to security events. • Lead cross-functional response coordination for security incidents. • Develop, design, and implement security operations enhancements to reduce risk. • Work with other business areas to enhance security and provide security awareness. • Research, evaluate, and implement security products and services as directed by security management.

• Architect the Modern SOC → Lead the end-to-end design of a cloud-native SOC, defining the strategy, Azure technical architecture, and operational model aligned with Zero Trust and business needs. • Translate Risk into Detection → Convert abstract security strategies and business risks into actionable detection logic by designing and maintaining advanced analytics rules using KQL in Microsoft Sentinel. • Optimize Security at Scale → Design cost-efficient ingestion and retention strategies, including Log Tiering (Analytics, Basic, Archive), balancing visibility, performance, and Azure ingestion costs. • Engineer SIEM & XDR Integrations → Architect seamless integrations between Microsoft Sentinel and the Microsoft Defender XDR suite (MDE, MDI, MDA, MDO), enabling bi-directional synchronization and enriched incidents. • Automate Response & Operations → Design and implement advanced SOAR playbooks using Azure Logic Apps or Power Automate to automate incident enrichment, response, and containment actions. • Enable Operational Excellence → Define SOC workflows, incident response processes, health monitoring, and KPI visualization (MTTD, MTTR, FPR), while mentoring Tier 3 analysts and ensuring sustainable operations.