Director of Cyber Operations

Our job everyday is to protect the data and critical assets of businesses world-wide by discovering hidden vulnerabilities… before the bad guys do!At CybelAngel, we see beyond perimeters to protect businesses from the most critical cybersecurity threats. Fortune 500 Global to mid-size companies world-wide, trust CybelAngel’s global team of approximately 130 team members to protect their businesses from digital threats. With a combination of advanced machine learning, cyber analysis expertise, and a powerful suite of software solutions, CybelAngel detects and resolves our clients potential threats, long before they can fall into the hands of cyber criminals.Our capabilities expand every day to uncover new risks, detect more threats, protect more clients, and create new possibilities for our employees.With employees based in France and in the US, CybelAngel’s global footprint allows for a thriving hybrid, office and remote-work environment. We are looking for exceptional ‘go-getters’ who share our ambitious vision, innovative culture especially considering our GenAI DNA, high commitment to ethics, and enthusiasm for being the best possible place to work!Our valuesBe BoldBe CuriousStronger TogetherWe are looking for our Director of Cyber Operations, based in Paris.The Director of CyberOps runs the department that turns CybelAngel's external threat visibility into actionable intelligence for clients. They bring a SOC operations background and use it to run the analyst team like a modern SOC: industrialized processes, capacity managed on data, clear SLAs and deliverables that plug into clients' SOC toolchains. They also own client integrations and drive innovation on sources and product features.Your responsibilities1. Run and industrialize operationsStructure the run: alert tiering, escalation paths, runbooks and playbooks per sourcesOrganize coverage: shifts, weekend on-call and follow-the-sun across EMEA and USOwn capacity planning: model workload per client, source, and size the team (FTE) accordinglyMonitor workload and productivity with objective activity data (alert volumes, time per case and per client, backlog, utilization) and rebalance capacity across podsAnticipate the FTE impact of new clients, modules and sources before they go liveConvert automation gains into measured FTE savings and reallocate freed capacity to higher-value workGuarantee service quality: SLA, report quality, NPS, cost to serve per client2. Own client integrationsLead the integration of CybelAngel intelligence into clients' SOC, CERT and CSIRT workflows (SIEM, SOAR, EDR/XDR, CTI platforms)Standardize integration patterns, connectors and onboarding to cut time-to-valueMake sure deliverables are directly actionable in client toolchains (formats, enrichment, severity mapping)3. Drive innovation on sources and product featuresIdentify, qualify and onboard new collection sourcesMeasure detection coverage and precision, and sponsor improvements (filtering, scoring, enrichment)Turn field insights into feature requests, and co-define priorities with Product and EngineeringLead prototyping with the Innovation Ops pod with clear success metrics4. Support the delivery of our Professional Services / Consulting offerAllocate analyst capacity from the Investigation & Consulting pod to client services / consulting engagementsGuarantee delivery quality on those engagements and protect run SLAs while doing it5. Lead and develop the departmentManage and coach the three Team Leads; run quarterly performance reviewsOwn the department's organization, roles and career paths (L1 to L5)Recruit, develop and retain key CyberOps talentSet data handling and ethical standards for sensitive investigationsRepresent CyberOps with client CISOs and SOC managers, and at selected industry eventsWhat success looks like after 12 monthsAn industrialized run: tiering, runbooks and on-call coverage in place across all podsA capacity model in place: FTE needs are forecast per client and module, and staffing decisions are made on dataMeasurable FTE savings from automation, reinvested in higher-value workStandard integration patterns for the main SIEM, SOAR and CTI platforms, with shorter time-to-valueNew sources onboarded and product improvements shipped from CyberOps field inputTeam Leads autonomous on their pod, with SLA and quality targets met across the departmentYour preferred experienceMust Have8 to 12 years in cybersecurity, with solid hands-on experience in a SOC, CERT or MSSP (analyst, lead, then manager)3+ years of team management, including managing managers or team leadsTrack record of structuring or industrializing a run team: tiering, runbooks, on-call, SLA managementWorkload modeling and capacity planning for an analyst or delivery teamWorking knowledge of the SOC toolchain, with hands-on experience across several of these categories:SIEM: Splunk, Microsoft Sentinel, IBM QRadar, ElasticSOAR: Palo Alto Cortex XSOAR, Splunk SOAR, TinesEDR / XDR: CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR, Palo Alto Cortex XDR, Sekoia.ioCTI platforms: MISP, OpenCTI, Recorded Future or equivalentGood command of CTI frameworks (MITRE ATT&CK, Diamond Model)Experience running automation or AI projects in an operations teamBudget ownership for a team or serviceFluent French and EnglishNice-to-haveExperience in an MSSP or a cyber product company, ideally a scaling B2B SaaSExperience integrating threat intelligence feeds into client SIEM/SOAR environmentsCertifications: GIAC (GCIH, GCTI, GCIA), CISSP, ITILSoft skillsPractitioner-leader: credible with analysts because they have done the job, credible with CISOs because they speak their languageIndustrializer: turns individual know-how into processes, runbooks and repeatable standardsData-driven operator: manages capacity and priorities with numbers, not intuitionAccountable: builds a culture of ownership and makes high-stakes calls with sound judgmentClose to the field: reviews cases, joins key client meetings, keeps technical depthCurious and humble: comfortable in a scaling company where processes are still being builtAt CybelAngel, we value diverse backgrounds. We encourage all qualified people to apply, regardless of origin, gender, gender identity or expression, sexual orientation, disability, age or beliefs.Our Benefits💰 Fixed gross salary between €70K and €80K, depending on experience and the impact demonstrated throughout the recruitment process,🏦 Bonus, based on company and individual performance🏢 Offices at Porte de Clichy (Paris 17 / Batignolles, metro lines 13 and 14, tram).🍱 Swile card for meal vouchers (€8 per day).👩‍⚕️ Company-subsidized health insurance, open to all family situations.🏡 Flexible remote work: up to 2 days per week after 1 month with the company.🏝️ 5 weeks of paid leave plus 8 to 10 RTT days for a better work-life balance.🏋️ €25 in monthly credits through our works council (CSE) for cultural, sports or leisure activities.🤝 Attractive referral bonuses, up to €2,000 per hire.🏃 Funding for one sports event per year (race, hike, etc.).🖥️ Remote work allowance to help you set up a comfortable home workspace.⚖️ Access to a free, confidential legal and administrative support platform.We are committed to creating an inclusive workplace and giving everyone an equal opportunity to succeed, regardless of their background, identity, or life experiences. We value diversity and believe that every individual, no matter their journey, deserves a chance to contribute and thrive.Your hiring journey with usExploratory call (30 min) with Romain, Talent Acquisition Manager. We talk about your background, what you are looking for next and how CybelAngel works, and we share the context of the role.Role deep-dive (45 min) with Marc, VP Finance & Operations. This is a detailed look at the CyberOps department today: pods, team leads, clients, the main challenges for the next 12 months, and how you would approach them.Business case (60 min) with Marc and Grégoire (VP Revenue). You get a realistic case about our operations one week in advance. You present your approach for 30 to 40 minutes, then we discuss it together. There is no single right answer. We care about how you think.Last meeting with Erwan, our CEO. We talk about vision, leadership and fit with our values.