Senior Manager, Cyber Security Operations

Position Summary Senior Manager, Cyber Security Operations is a hands‑on, “player‑coach” leader building and continuously improving security operations as Ardelyx transitions from an MSP to an internal IT/security organization. Responsibilities Lead and participate in incident detection, investigation, and response across endpoint, identity, cloud, and SaaS (alert triage, log analysis, threat intel). Coordinate incident response with Legal, HR, Compliance, and Communications; conduct post‑incident reviews and improve response processes. Establish/track security operations metrics (MTTD, MTTR, incident trends); tune detection rules, playbooks, and SOAR automation. Own and mature Microsoft security ecosystem: Defender XDR, Microsoft Sentinel (SIEM/SOAR), Purview; drive integration/automation for unified detection & response. Design/optimize controls across endpoint (EDR/XDR), identity (Entra ID, MFA, Conditional Access), Azure, AWS, and SaaS; lead vulnerability management (scanning, prioritization, remediation tracking). Operationalize threat intelligence into Sentinel; build SOAR playbooks via Logic Apps. Initially operate hands‑on while building/mentoring a team of 2 security engineers (3–4 months); provide escalation support. Execute cybersecurity roadmap; identify control gaps and implement improvements aligned to risk tolerance. Partner on audits/risk/regulatory needs (NIST CSF 2.0, ISO 27001, SOC 2, HIPAA) and contribute to security policy. Support third‑party risk management, vendor evaluations, and platform consolidation. Qualifications Bachelor’s in Information Security/CS or related. 8+ years cybersecurity experience focused on security operations/engineering. Hands‑on Microsoft security stack: Defender for Endpoint, Defender for Identity, Defender for Office 365, Microsoft Sentinel. Identity & access management: Entra ID, MFA, Conditional Access, PIM. Cloud security: Azure (required); AWS (plus). Experience across hybrid cloud. Experience building/leading SIEM, vulnerability management, and security automation programs. Familiarity with NIST CSF, ISO 27001, SOC 2, HIPAA. Player‑coach leadership; strong communication translating technical risk to business impact. Preferred certifications: CISSP, CISM, CRISC, CCSP, GCIH, etc. Benefits 401(k) with generous employer match; 12 weeks paid parental leave; up to 12 weeks living organ/bone marrow leave; equity incentives; medical/dental/vision; life insurance & disability; flexible time off; Winter Holiday shutdown; at least 11 paid holidays. Compensation Anticipated base pay range: $175,000–$213,000 (plus possible bonus and equity, subject to eligibility). #J-18808-Ljbffr Socket.dev