• Maintain and continuously improve incident response plans, playbooks, and tabletop exercises, cloud- and identity-specific response scenarios.

• Establish and track key operational metrics (mean time to detect/respond, alert volumes, false-positive rates) and report on security operations performance to the Director.

• Oversee vulnerability management operations across cloud infrastructure, endpoints, containers, and applications, including risk-based prioritization and coordination of remediation with Engineering and IT.

• Serve as an escalation point and on-call leader during active security incidents, including after hours as required.

Cloud Security (AWS & Azure)

• Own day-to-day cloud security operations across Aderant's production AWS and Azure environments, including detection, triage, and response to cloud control-plane and workload threats.

• Manage cloud security posture management (CSPM) operations: monitor for misconfiguration and drift, prioritize findings by real-world risk, and drive remediation with Cloud Engineering and IT.

• Establish and maintain cloud security guardrails and baselines — logging and telemetry coverage, network segmentation, encryption, secrets handling, and secure-by-default configuration standards.

• Lead identity and access security operations in the cloud and across the enterprise: privileged access, role and permission hygiene, conditional access, MFA enforcement, and detection of identity-based attack techniques such as token theft, session hijacking, and consent abuse.

• Ensure comprehensive security telemetry from both cloud platforms is ingested, normalized, and covered by detections in the SIEM.

• Partner with Cloud Engineering on the security of container and orchestration platforms, infrastructure-as-code pipelines, and the edge/WAF layer protecting customer-facing services.

• Support cloud security architecture reviews for new services, regions, and platform changes, and translate the outcomes into operational monitoring requirements.

Application & Product Security

• Partner with Engineering and Product to embed security detection, logging, and response requirements into application and infrastructure changes.

Detection Engineering, Automation & AI Enablement

• Build and tune detection content mapped to MITRE ATT&CK (including cloud and identity techniques), measuring and closing coverage gaps rather than only responding to vendor-supplied alerts.

• Drive automation of repeatable detection, enrichment, and response tasks to improve team efficiency and reduce mean time to respond.

• Apply AI tools — including Claude and Aderant-approved AI assistants — to accelerate investigation, detection development, documentation, and reporting, and establish sound team practices for their use.

• Contribute to the secure and responsible use of AI across Aderant, including deployment and management of our AIDR solution and monitoring for AI-related risks such as data leakage and shadow AI usage.

• Evaluate and recommend security operations tooling (SIEM, SOAR, EDR, CSPM, threat intelligence) to improve detection and response capability.

• Stay current on the threat landscape relevant to legal technology, SaaS, and cloud environments, and translate intelligence into detection use cases.

Team Leadership

• Manage, mentor, and develop a team of security analysts and engineers, including hiring, performance management, and career development.

• Establish on-call rotations, staffing coverage, and workload distribution to ensure 24/7 operational readiness.

• Build a culture of accountability, continuous learning, and operational rigor within the team.

Cross-Functional Collaboration

• Partner with IT, Engineering, and Product teams to embed security detection and response requirements into infrastructure and application changes.

• Support the Director, Head of Information Security in preparing security posture updates for executive leadership and, where applicable, customer and audit inquiries.

• Coordinate with Legal and Compliance on regulatory or contractual incident notification obligations.

Required Qualifications

• 5+ years of experience in information security, with at least 3 years in security operations, incident response, or threat detection.

• 2+ years of experience directly managing or leading a security team, including hiring and performance management.

• Hands-on experience securing and monitoring public cloud environments — substantive depth in both AWS and Azure (or deep expertise in one with demonstrated working knowledge of the other), including cloud logging and telemetry, IAM, and cloud-native security services.

• Practical experience with cloud security posture management and remediating misconfiguration at scale in a production environment.

• Hands-on experience with SIEM platforms EDR, and CSPM tools (CrowdStrike preferred)

• Experience managing the incident response processes in a production environment.

• Working knowledge of common attack techniques, threat actor behavior, and the MITRE ATT&CK framework, including cloud and identity techniques..

• Experience developing or maturing incident response plans, playbooks, and post-incident reviews.

• Demonstrated use of AI tools (such as Claude or comparable assistants) to improve security operations quality and efficiency, with sound judgment about where they are and are not appropriate.

• Strong written and verbal communication skills, including experience communicating incident status to non-technical stakeholders and leadership.

• Proficiency securing Cloud environments (AWS and Azure).

• Bachelor's degree in Computer Science, Information Security, or related field, or equivalent professional experience.

Preferred Qualifications

• Experience in a SaaS, legal technology, or software company handling sensitive or regulated client data.

• Relevant certifications such as CISSP, GCIH, GCIA, CISM, or equivalent.

• Cloud security certifications such as AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate (AZ-500), GCSA, or GCLD.

• Experience with a unified endpoint and cloud security platform such as CrowdStrike Falcon (Aderant's preferred platform), or comparable EDR/CNAPP tooling.

• Experience with edge security and web application firewall platforms such as Cloudflare.

• Familiarity with cloud-native security services (AWS GuardDuty, Security Hub, CloudTrail; Microsoft Defender for Cloud, Entra ID Protection, Azure Monitor/Sentinel).

• Experience securing containers and orchestration platforms (Docker, Kubernetes, EKS/AKS) and infrastructure-as-code (Terraform) pipelines.

• Experience with SOAR platforms and security automation/orchestration.

• Experience managing a co-managed SOC or MSSP relationship.

• Familiarity with SOC 2, ISO 27001, or similar compliance frameworks and how operational security supports audit readiness.

• Experience operating in a global, multi-region environment.

Originally posted on Himalayas