Security Operations Lead

About the Role

As SecOps Lead, you'll own the operational effectiveness of Pelico's security monitoring, incident response, and vulnerability management capabilities. You'll turn security alerts and findings into actionable investigations, prioritized remediation, and measurable risk reduction - building the security operations foundation needed to protect our platform, support enterprise customers, and enable future regulated deployments.

This is a hands-on technical leadership role. You'll work closely with the CISO, Engineering, IT, and external security partners to build reliable, scalable security operations without creating unnecessary friction for product development and delivery.

What You'll Do

• Own security monitoring, detection, and incident response. Implement and operate SIEM and SOAR capabilities alongside our managed Security Operations Center (SOC). Ensure reliable telemetry across cloud, application, and identity environments; build and tune detections for account compromise, privilege escalation, suspicious cloud activity, and data exfiltration; and establish dependable 24/7 monitoring and escalation processes.
• Lead security investigations and response readiness. Develop incident response playbooks and automate enrichment, triage, and repeatable response actions. Lead technical investigations with Engineering, IT, and external providers, establish appropriate approval gates for disruptive actions, exercise response plans, and translate lessons learned into practical improvements.
• Own vulnerability management and CNAPP operations. Deploy and operate a Cloud-Native Application Protection Platform (CNAPP) across in-scope cloud assets, workloads, containers, and code repositories. Prioritize findings based on exploitability, exposure, asset criticality, and attack-path context - not severity scores alone - and bring cloud, code, dependency, secrets, and independent testing findings into a single actionable remediation workflow.
• Drive accountable remediation and security testing. Partner with Engineering to assign remediation owners, establish deadlines, verify fixes, manage remediation SLAs, and escalate overdue risks. Coordinate urgent mitigations for actively exploited vulnerabilities, maintain time-bound risk exceptions approved by the CISO, and address recurring root causes through secure defaults and automation. Plan penetration tests with qualified external providers and evaluate AI-powered agentic penetration testing capabilities with explicit authorization, controlled scope, human oversight, and appropriate data safeguards.
• Strengthen cloud security and secure delivery. Partner with Engineering to improve cloud IAM, secrets management, network exposure, encryption, logging, and secure configuration, including protective controls such as a production WAF. Embed code, dependency, container, and secrets checks into CI/CD and infrastructure-as-code workflows, establish practical risk-based release gates, and contribute to threat modeling and security reviews for significant architecture changes, integrations, AI use cases, and customer deployments.
• Build operational assurance and regulated readiness. Maintain security runbooks, coverage inventories, and evidence of operational controls in partnership with the CISO and GRC. Support ISO 27001, SOC 2, enterprise customer assurance, and future US regulated deployments through appropriate logging, access controls, vulnerability remediation, incident coordination, and controlled releases. Maintain defined data and access boundaries, ensuring regulated customer data stays out of unauthorized tools and environments.

About You

• Strong hands-on experience in security operations, cloud security, or DevSecOps, with direct ownership of production security capabilities.
• Experience deploying and operating SIEM solutions, building and tuning detections, investigating alerts, and partnering with an internal or managed SOC.
• Practical experience with SOAR or security automation, including integrations, enrichment, and safe response workflows.
• Experience operating a CNAPP or equivalent cloud and workload security tooling, with a track record of driving findings through remediation and verifying fixes.
• Solid understanding of cloud IAM, networking, logging, containers, Kubernetes, and infrastructure as code, including how misconfigurations and vulnerabilities combine to create exploitable attack paths.
• Familiarity with secure SDLC practices, CI/CD, dependency and container scanning, secrets detection, and vulnerability remediation.
• Ability to automate security workflows using Python, shell scripting, APIs, or equivalent tools.
• Experience coordinating technical incident response and communicating clearly under pressure, with sound judgment around containment, escalation, and approval requirements.
• Ability to influence Engineering teams, translate technical findings into practical fixes, and balance security urgency with business and operational constraints.
• Strong written communication in English, disciplined documentation, and comfort working across US and European teams.
• You actively embrace AI tools as part of how you work - curious about what's possible and quick to adopt new ways of working smarter and faster.
• Hands-on experience with AI-assisted workflows and a genuine interest in staying at the frontier of what these tools can do.

Nice to have

• Experience with Azure security and cloud-native production environments.
• Experience supporting ISO 27001, SOC 2, enterprise customer security requirements, or independent security testing programs.
• Familiarity with US defense-related requirements such as DoD IL5, NIST SP 800-171, CMMC, or ITAR, including shared-responsibility models and controlled-data boundaries.
• Experience building a security operations capability in a growing SaaS company.