Director, Security Operations

Accelerant

. Report directly to the Chief Information Security Officer (CISO) .

Posted 11/9/2026full-timeRemote • United StatesLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security engineering with a focus on cloud security, network security, and detection engineering, particularly in Azure and Microsoft Sentinel. Proven ability to lead incident response, manage security operations, and develop strategic security playbooks for mergers and acquisitions.

Highest-signal resume keywords

Security Engineering ExperienceIncident Response LeadershipCloud Security ExpertiseMicrosoft Sentinel ManagementVendor Relationship Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security OperationsRisk AssessmentPenetration TestingTechnical Incident ResponseSecurity Tooling ManagementCloud SecurityNetwork SecurityDetection EngineeringIdentity and AuthenticationPost-Incident Reviews

Soft Skills

Clear CommunicationSound JudgmentPrioritization SkillsCoaching and DevelopmentLeadership

Tools & Technologies

Microsoft SentinelAzureAWSCloudflareSIEM

Certifications & Qualifications

CISSPCISMGIACAZ-500SC-200

Industry Keywords

InsuranceFinancial ServicesRegulated IndustryMergers and AcquisitionsSecurity Vendor Management

Tech Stack

Tools & technologies

AWSAzureCloud

About the role

Key responsibilities & impact

Report directly to the Chief Information Security Officer (CISO)
Set technical direction for the security operations team and act as the CISO’s trusted deputy for technical security and security operations
Own the strategic direction of technical security operations, controls and processes
Lead security due diligence and post-close integration assessments for mergers and acquisitions
Build and maintain a repeatable M&A integration playbook, including assessment checklist, risk scoring, remediation plan and day-one controls
Write risk narratives and recommendations for the CISO and deal teams
Lead the penetration test cycle, including scoping, triage, remediation tracking and leadership reporting
Own SOC coordination across Accelerant and Mission US/UK, including shared priorities, escalation paths, handoffs and coverage gaps
Own detection platform strategy, including Microsoft Sentinel cost and ingestion management
Act as incident response manager for technical incidents from triage through resolution
Own and maintain technical incident response playbooks
Lead post-incident lessons-learned reviews and track control changes through completion
Run control reviews and recommend improvements
Serve as the internal escalation point for the external SOC
Build and lead the security engineering team, including hiring, line management, work assignment, output review and coaching
Manage security tooling and service vendors through selection, renewals, performance and escalations
Perform hands-on engineering and investigation work as needed

Requirements

What you’ll need

6 to 9 years of security engineering experience
Breadth across cloud security, network security and detection engineering, with depth in Azure and Microsoft Sentinel
Experience leading incident response for technical incidents, including post-incident reviews
Experience assessing the security of acquisitions
Familiarity with modern identity and authentication, including passkeys and privileged access
Experience hiring, line-managing and developing security engineers
Able to write a clear risk narrative and present it to leadership
Sound judgment on ambiguous problems, and good prioritization across competing demands
Experience managing security vendor relationships
Willing to stay close to the technical work; this is not a pure management role
Preferred: experience assessing acquisition targets or integrating acquired companies, including building repeatable playbooks
Preferred: experience running a recurring penetration testing or automated pentest program and driving remediation
Preferred: experience coordinating a SOC or managed detection provider across multiple entities or regions
Preferred: experience with Microsoft Sentinel and SIEM cost optimization
Preferred: experience securing AWS environments and working with Cloudflare
Preferred: experience rolling out phishing-resistant authentication such as passkeys or FIDO2
Preferred: certifications such as CISSP, CISM, GIAC, AZ-500 or SC-200
Preferred: experience in insurance, financial services or another regulated industry