Manager of Global Cyber Defense

The role

You will lead the Security Operations and Incident Response teams. You will architect strategies, tools, and policies to safeguard enterprise data, corporate infrastructure, and cloud-native environments.

What you will do

• Recruit, mentor, and develop a global team of cyber defense engineers and security analysts.
• Author and maintain enterprise-wide cyber defense frameworks, incident response playbooks, and operational blueprints.
• Own the strategic architecture, tooling, and day-to-day operations of the Security Operations Center (SOC).
• Oversee the rapid identification, containment, and remediation of advanced cyber attacks and vulnerabilities.
• Evaluate, select, and integrate security technologies focusing on automation, telemetry, and SIEM optimization.
• Champion threat modeling, breach simulations, and tabletop exercises.
• Partner with internal learning teams to institutionalize security playbooks and upskill teams.
• Establish, track, and report on high-impact cyber defense KPIs to executive leadership.
• Manage the Cyber Defense roadmap within an agile engineering framework.

Required qualifications

• Proven track record of mitigating advanced persistent threats (APTs) and sophisticated cyber adversaries.
• In-depth, foundational knowledge of SOC design, including advanced logging strategies, network segmentation, cloud telemetry, and honeypots.
• Strong technical understanding of securing enterprise SaaS platforms and cloud environments (AWS, Azure, or GCP).
• Demonstrated ability to build, automate, and orchestrate effective incident response workflows.
• Strong working knowledge of security risk management and threat frameworks (e.g., NIST CSF, MITRE ATT&CK).
• Bachelor’s degree in Computer Science, STEM, or equivalent real-world technical experience.
• Proven capability to manage technical teams and high-pressure situations.
• Exceptional English communication skills.

Nice to have

• Hands-on experience spanning both offensive (red teaming/penetration testing) and defensive (blue teaming) disciplines.
• Familiarity with leveraging data analytics, SIEM engineering, or process-oriented workflows to optimize security operations.
• Relevant elite certifications such as CISSP, CISM, or GIAC.
• Experience managing and securing corporate endpoint fleets at a global scale.

Benefits

• Restricted Stock Units (RSUs) and merit-based refresh grants
• 24 weeks of fully paid leave for primary carers
• 12 weeks of fully paid leave for supporting carers
• Unlimited PTO in applicable regions
• Generous PTO globally
• Flexible hybrid work model
• 70-20-10 learning framework, mentorship programs, and access to a dedicated learning platform
• Subsidized Wellhub memberships
• Mental health counseling
• Dedicated Wellness Weeks
• Paid time off to volunteer for community and environmental causes via annual Impact Days

About the company

Celonis is the trusted platform to industrialize Enterprise AI. The company is headquartered in Munich, Germany, and New York City, USA, with more than 20 offices worldwide.