Manager, Security Operations & Incident Response

Davis Polk & Wardwell LLP (including its associated entities) is an elite global law firm with world-class practices across the board. Clients know they can rely on Davis Polk for their most challenging legal and business matters. From offices in the world's key financial centers and political capitals, our more than 1,000 lawyers collaborate seamlessly to deliver exceptional service, sophisticated advice and creative, practical solutions. Visit davispolk.com .

Position Summary

The Manager, Security Operations & Incident Response leads the Firm’s ability to detect security threats and to respond when preventive controls fail. The role owns incident command, detection engineering, exposure management, threat intelligence, and governance of the Firm’s managed detection and response provider. The ideal candidate is a hands-on leader with demonstrated incident command experience, sound judgment under pressure, and the ability to work directly with the Firm’s General Counsel’s office and outside counsel. This is a working leadership role with responsibility for building, leading and growing a small, senior team.

Essential Duties and Responsibilities

Typical responsibilities include, but are not limited to, the following:

- Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery.
- Operate the Firm’s incident response framework, including triage of Events of Interest, Incidents including severity determination and escalation.
- Produce incident documentation to the Firm’s evidentiary standard, and coordinate with internal and external stakeholders, including matters conducted under legal privilege, supporting the CISO on notification analysis, cyber insurance and law enforcement engagement.
- Lead post-incident review, drive root cause remediation through the responsible owners, and design and conduct tabletop exercises including exercises involving Firm leadership and counsel.
- Own the detection program across SIEM, endpoint, identity, email and browser telemetry, including use case development, tuning and lifecycle management.
- Measure and report detection coverage against prioritized MITRE ATT&CK techniques, and manage alert quality and false positive rates as primary measures of effectiveness.
- Own the operational relationship with the Firm’s managed detection and response provider, including escalation paths, quality review of provider output, service level performance and expansion of scope.
- Own the exposure management cycle across vulnerabilities, misconfigurations, attack paths and internet-facing exposure, prioritizing on known exploitation, asset criticality and privilege rather than severity score alone, and verifying remediation independently.
- Translate threat intelligence into detections, hunts and briefings, track threat activity relevant to the legal sector and to the Firm’s client base, and own monitoring and takedown of brand impersonation and lookalike domains.
- Lead, develop and grow a team of security analysts and engineers, setting priorities, quality standards and on-call expectations.
- Provide operational input to security engineering on control design, and to governance and compliance on risk, metrics and audit evidence.

Qualifications/Position Requirements

- Demonstrated incident command during live security incidents, including direct coordination with legal counsel.
- Hands-on depth with SIEM, endpoint detection and response, and detection engineering; this is not a purely supervisory role.
- Experience governing a managed security service provider, including quality review of provider output rather than acceptance of it.
- Practical command of MITRE ATT&CK, and familiarity with NIST SP 800-61, the NIST Cybersecurity Framework, and ISO27001.
- Experience driving vulnerability and exposure remediation through teams outside the direct reporting line.
- Calm, structured judgment under pressure, and the willingness to state clearly what is not yet known rather than declare an incident contained prematurely.
- Written communication of a standard suitable for review by counsel and by Firm leadership, and strong interpersonal skills with the ability to influence at all levels of the organization.
- Strong work ethic, and an excellent use of discretion and judgment in an environment handling privileged and market-sensitive information.
- Experience in a law firm, professional services firm or financial institution preferred.

Education and/or Experience

- A Degree in Information Technology, Engineering or a related field.
- Minimum of 8 years’ experience in information security, including at least 3 years leading incident response or security operations.
- Key industry certifications such as GCIH, GCFA, GCIA, CISSP or CISM preferred.

Compensation

The expected base salary for this position ranges from $240,000 - $300,000. Salary offers are based on a wide range of factors including relevant skills, training, experience, education, and, where applicable, licensure or certifications obtained. Market and organizational factors are also considered. Davis Polk offers a competitive salary and comprehensive benefits package.