Note: The job is a remote job and is open to candidates in USA. Cipher Digital is an industrial-scale data center construction and operations company focused on high performance computing and AI. The Director of Security Operations will establish and lead the Security Operations function, ensuring effective security monitoring, incident response, and vulnerability management across IT and cloud environments.
Responsibilities
- Stand up and own security monitoring and detection across IT, OT, cloud, and tenant-boundary traffic. Cipher owns the function and controls its own detection content
- Maintain the security posture the organization defines, operating the security tooling the engineering team builds
- Own the metrics that prove coverage (time to acknowledge, time to respond) and the detection coverage map against recognized adversary frameworks for both IT and ICS
- Partner with security engineering on the detection handoff: they build detection-as-code, you operationalize and run it
- Build the incident response plan into a tested, audit-defensible capability and own it end to end. Define the response operating model, escalation paths, and the responsibility map across Cipher, tenants, and vendors
- Coordinate the response across peer functions, Data Center Operations, Physical Security,GRC, Security Engineering, IT, and Networking. Set the interface and handoff with each ahead of an incident, so a live response runs to plan and meets or exceeds Cipher's notification timelines
- Leverage modern Security Orchestration, Automation, and Response (SOAR) capabilities to automate containment, enrich alerts, and reduce manual analyst fatigue. Empower the SOC to continuously build and refine visual playbooks to streamline response
- Lead live incident response, including multi-party incidents that cross regions, tenants, and time zones
- Author and sign joint incident-response run books with tenants and partners ahead of go-live, meeting or exceeding contractual notification timelines
- Run regular security drills across IT and OT and feed the lessons back into the plan
- Own detection and response delivery end to end. Where we contract or subcontract, select and manage the providers, enforce SLAs with financial credits on miss, and hold them accountable to delivery and transparency
- Drive consolidation and reduce concentration risk so detection and response do not rest on a single provider
- Coordinate the function so it operates as an extension of Cipher, not a black box, regardless of who delivers it
- Run the vulnerability management program as a shared lifecycle: GRC defines the policy, risk tolerance, and severity model; security engineering implements the scanning and remediation tooling; operations maintains the program and responds. You own the cadence, the enforced remediation SLAs, and the reporting, with risk-based prioritization rather than raw scores
- Keep the three functions feeding each other: surface what you see in operation back to GRC and engineering so the policy and the tooling sharpen, rather than each working in isolation
- Maintain continuous awareness of the attack surface as the footprint scales across sites and tenants
- Build and lead the Security Operations function, growing capability as the footprint scales
- Communicate operational posture, incident readiness, and response outcomes clearly to theCISO and executive leadership
- Make security a capability the whole business shares: educate teams, run exercises, and help them respond well. Be a partner, not a blocker
Skills
- Deep experience leading security operations or incident response, including time spent running major incidents under real pressure
- Operations as a lived discipline, not a recent addition to a broader role
- Demonstrated command of multi-party, multi-region incident response, with strong stakeholder communication under pressure
- Experience standing up and running detection and response, including managing providers and subcontracted services with SLA negotiation and enforcement
- Strong knowledge of SOC operations, SIEM, EDR, SOAR, and detection engineering, and how they combine into effective detection and response
- Familiarity with SOC 2, ISO 27001, NIST 800-53, SOX, and partner notification obligations as they shape operational evidence and timelines
- OT/ICS incident response or critical-infrastructure operational exposure is a strong plus
- Relevant certifications (CISSP, GIAC such as GCIH or GCIA, CISM) strongly preferred
Benefits
- 401K Retirement Plan with match
- Medical, Dental and Vision Insurance
- Life and Disability Insurance
- And other perks!
Company Overview