Cyber Defense Unit Manager

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution. We are looking for an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. You will build a high-performing team and continuously improve our ability to anticipate, detect, and respond to evolving cyber threats. The ideal candidate combines deep cybersecurity expertise, operational leadership, and people management to build a modern, intelligence-driven cyber defense function. You are comfortable operating in a fast-paced global technology environment and can move seamlessly between strategy, hands-on operations, major incidents, and executive-level communication.WHAT YOU’LL DOStrategy and LeadershipLead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement (e.g., against NIST CSF or SOC-CMM)Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, ensuring coverage across time zones, including follow-the-sun or on-call modelsDefine the build-versus-buy approach for the function, including management of MDR/MSSP and other external partners, and manage the Cyber Defense budgetSecurity Operations, Monitoring, and Threat HuntingOversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environmentsEstablish and maintain SOC processes, runbooks, severity definitions, and handoffs to ensure consistent, high-quality investigationsLead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threatsDetection EngineeringOwn the detection engineering lifecycle: use case development, testing, tuning, deployment, and retirement, with a focus on reducing false positives and alert fatigueMap detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk Ensure telemetry completeness by defining log source requirements and onboarding priorities with IT, Cloud, and Engineering Run purple team and adversary emulation exercises to validate detection and response effectivenessIncident Response Lead response to significant cybersecurity incidents, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadershipMaintain and test incident response plans, playbooks, and crisis communication procedures, including regular tabletop exercises with senior stakeholdersOversee digital forensics, evidence handling, containment, eradication, and recovery, working with Legal to preserve privilege and support investigations, legal holds, and regulatory inquiries Support breach assessment and regulatory notification decisions with Legal and Compliance (e.g., GDPR, HIPAA, SEC disclosure, and other applicable obligations)Run post-incident reviews and drive corrective actions to closure. Threat Intelligence Build and manage a threat intelligence capability that tracks threat actors, campaigns, and techniques relevant to Acronis, its customers, and the MSP ecosystemTranslate intelligence into actionable detections, hunts, blocking actions, and risk-informed recommendations for leadershipParticipate in industry intelligence-sharing communities and partnerships (e.g., ISACs, peer groups, law enforcement liaison)Technology, Automation, and AIOwn and optimize core cyber defense technologies, including SIEM, EDR/XDR, SOAR, and threat intelligence platforms, including roadmap, integrations, and vendor performanceDrive automation and AI-assisted capabilities to improve detection, enrichment, triage, investigation, and response, with appropriate governance and human oversightLeverage Acronis’ own products and platform capabilities where appropriate to strengthen internal defenseMetrics, Reporting, and Executive CommunicationEstablish KPIs and reporting for cyber defense effectiveness, such as MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposureReport cyber defense posture, major incidents, and risk trends to senior leadership, and when needed the Board and Audit Committee Cross-Functional PartnershipPartner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security postureCoordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritizationSupport audits, customer assurance requests, and regulatory requirements related to monitoring and incident responseWHO WE’RE LOOKING FORSignificant cybersecurity experience (typically 10+ years) in security operations, incident response, threat detection, or cyber defense, including 5+ years leading teamsProven experience leading cybersecurity teams within a global technology or software environment, including distributed, multi-time-zone teamsDemonstrated experience leading major incident response efforts from detection through recovery and post-incident reviewStrong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CKHands-on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including evaluation and optimizationExperience with threat hunting and detection engineering, including detection-as-code practicesStrong understanding of AWS, Azure, or other modern cloud environments, including cloud-native logging, detection, and responseExperience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirementsExperience leveraging automation, scripting (e.g., Python), and ideally AI within security operationsExperience managing budgets, vendors, and managed security service providersStrong leadership, analytical, and decision-making skills, particularly during high-pressure incidentsAbility to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiencesHigh integrity and sound judgment when handling sensitive, confidential, and privileged informationRelevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP are a plusWHO WE AREA Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses. Our corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.OUR INTERVIEW PRACTICESTo maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you—not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process.Use of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.The US pay range for this position is $170,000–$260,000. This range reflects the minimum and maximum total target annual compensation for this role across all U.S. locations. The actual compensation offered at the start of employment is determined based on factors including, but not limited to, experience level, knowledge, skills, and geographic location. In addition to competitive compensation, this role includes a comprehensive benefits package featuring medical, dental, and vision coverage, flexible spending accounts (FSA), disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.SummaryLocation: Burlington, MA, USA; Virginia, USA - Remote; Florida, USA - RemoteType: Full time