[Remote] Senior Manager, Security Operations

Note: The job is a remote job and is open to candidates in USA. Motive provides an AI-powered platform that helps organizations manage physical operations, including safety, productivity, vehicles, equipment, and fleet-related spending. The Senior Manager, Security Operations will build and lead Motive's SOC, owning detection and response across product, production, enterprise, and corporate environments, including incident response, threat hunting, security analytics, endpoint and workload security, and AI-first automation.

Responsibilities

• Stand up and grow the SOC — operating model, coverage structure, runbooks, escalation paths, hiring and career development for a globally distributed team — and decide the 24/7 coverage model, whether in-house follow-the-sun, MDR-augmented or hybrid
• Own Motive's detection strategy and coverage posture across both estates, treating detection content as code and mapping coverage explicitly against MITRE ATT&CK and Motive's own threat model, with a live view of gaps closed in risk order
• Extend detection into production and cloud workloads in close partnership with Platform Engineering — the highest-priority coverage expansion for the function — and build detections that span the boundary, since identity compromise on a corporate endpoint pivoting into cloud infrastructure is the attack path that matters most
• Own 24/7 incident response across product and enterprise environments, serve as incident commander for significant incidents, and be the calm, credible voice to executives when one is underway
• Own the security telemetry and analytics platform — collection, normalization, enrichment, retention and cost — and instrument the function honestly on MTTD, MTTR, detection coverage, alert precision and automation rate
• Establish a structured, hypothesis-driven threat hunting program and a threat intelligence capability tailored to Motive's sector, translating intel into detections, hunts and hardening priorities rather than newsletters
• Own EDR across the corporate fleet and, with Platform Engineering, runtime and workload protection for production, treating any unmonitored endpoint as an open finding rather than an accepted condition
• Own the operational side of phishing and social engineering defense — detection, reporting triage, takedown and credential-compromise response — partnering with the Compliance and Trust function, which owns simulation and awareness training
• Architect the AI-first operating model for the SOC, personally building and iterating on triage, enrichment, correlation and investigation automation rather than delegating it to a vendor

Skills

• 8+ years in security operations, incident response, detection engineering or threat intelligence, with 3+ years leading teams
• Demonstrably hands-on. You have personally written detections, run investigations, led incidents as commander and built automation — recently, not early in your career. Be prepared to walk through work you did with your own hands
• Experience building or substantially rebuilding a SOC function, rather than only operating within an established one
• Credible across both estates — production and cloud security monitoring as well as corporate and enterprise security operations. Candidates strong in only one should be ready to show how they would build the other
• Deep experience with modern detection and response tooling — SIEM and security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry — plus strong detection engineering skills you can apply personally
• Solid grounding in identity-centric attack paths — SSO, OAuth, session compromise, MFA bypass and privilege escalation across SaaS and cloud
• Proven incident command experience on significant incidents, including executive communication under pressure, and the judgment to escalate appropriately without crying wolf or sitting on something serious
• Concrete, demonstrated use of AI to run security operations — triage, enrichment, detection authoring, investigation support or reporting. We will ask what you built, what it replaced, and what it measurably changed. General enthusiasm for AI is not what we're looking for
• Experience building 24/7 coverage and leading globally distributed teams across multiple timezones
• The applicant must be authorized to receive and access those commodities and technologies controlled under U.S. Export Administration Regulations
• Strong background in cloud and container security monitoring, with AWS and Kubernetes strongly preferred, including the practical reality that production monitoring must be introduced without destabilizing production
• Experience in transportation, logistics, IoT and connected devices, or critical infrastructure is a plus

Benefits

• Health, pharmacy, optical and dental care benefits
• Paid time off
• Sick time off
• Short term and long term disability coverage
• Life insurance
• 401k contribution (all benefits are subject to eligibility requirements)
• Restricted stock units may be included in total compensation for certain roles

Company Overview

Company H1B Sponsorship