Manager Threat Operations

Role Summary

Sophos is seeking an experienced and motivated MDR Operations Manager is will be responsible for leading high-performing MDR teams and delivering consistent, high-quality security operations as part of our global 24x7 service. Based in Australia, this role will lead operational delivery during APJ hours, with a strong focus on people development, operational health, investigation quality, customer outcomes, and effective cross-region collaboration.

The role will use operational data, technology, automation, and continuous improvement to identify and remove friction, improve how our teams work, and help MDR operate more effectively at scale. Working closely with MDR leadership and partner teams, the MDR Operations Manager will ensure the operation is prepared for today’s demands while continuously improving how we respond to an evolving threat landscape.


What You Will Do

• Lead and develop MDR Team Leads and analysts, setting clear expectations, providing regular coaching and feedback, supporting career development, and building an inclusive, accountable, high-performing team culture.

• Build leadership capability and succession within the operation by identifying, mentoring, and developing future technical and people leaders.

• Lead MDR operational delivery during APJ hours, ensuring appropriate staffing and coverage, effective workload balancing, queue health, prioritization, and achievement of service-level and customer commitments.

• Maintain a clear view of operational health, including demand, capacity, backlog, response times, investigation effort, quality, escalations, and emerging operational risks, taking action before issues materially impact customers or teams.

• Operate as part of a global 24x7 MDR service, working closely with leaders and teams across regions to maintain consistent operational standards and continuity of service.

• Ensure effective follow-the-sun operations through clear ownership, high-quality handovers, and timely escalation of operational risks and customer issues between APJ and other regions.

• Drive consistent and effective triage and investigation practices, ensuring analysts make sound decisions, focus effort where it creates the greatest customer value, and escalate cases appropriately based on risk, complexity, and customer impact.

• Establish and maintain high standards for investigation quality, case handling, documentation, customer communication, and operational processes. Use quality reviews, case reviews, coaching, and operational data to identify and address gaps.

• Use operational data and metrics to understand trends, identify performance and capacity issues, make informed staffing and prioritization decisions, and drive measurable improvements in operational efficiency, investigation quality, and customer outcomes.

• Act as a senior operational escalation point for customer-impacting situations, complex investigations, service risks, workload challenges, and cross-team dependencies, ensuring clear ownership, timely communication, and effective resolution.

• Support major security incidents and high-severity customer situations by coordinating appropriate MDR resources, ensuring effective escalation and handoffs, and maintaining clear communication with internal and customer stakeholders.

• Ensure operational resilience by maintaining appropriate contingency plans for unexpected demand, staffing constraints, tooling disruption, major incidents, and other events that could affect MDR service delivery.

• Build and maintain operational readiness through skills coverage, onboarding, training, knowledge management, playbooks, processes, tooling readiness, and appropriate leadership coverage.

• Lead operational readiness and change adoption for new detections, capabilities, tooling, automation, workflows, and process changes, ensuring teams understand what is changing, are prepared to operate effectively, and that intended improvements are realized after implementation.

• Identify and reduce operational friction, including noisy or low-value work, repetitive analyst activity, inefficient workflows, unnecessary escalations, and process gaps. Translate these opportunities into improvements through standardization, automation, tooling, or process redesign.

• Partner closely with Threat Intelligence, Detection Engineering, Incident Response, Product, Engineering, and other teams to improve detection quality, investigation effectiveness, and MDR's overall detection and response capability.

• Drive continuous improvement by turning operational data, analyst feedback, customer escalations, quality findings, and lessons learned into measurable improvements to MDR workflows and service delivery.

• Maintain a strong operating rhythm across the teams, ensuring operational priorities, risks, performance, improvement initiatives, and dependencies are visible, understood, and acted upon.

• Bring APJ operational perspectives, risks, and requirements into global MDR planning while driving consistent processes, standards, and customer outcomes across regions.

• Work closely with MDR leadership on capacity planning, operational strategy, organizational priorities, and transformation initiatives that improve scalability, efficiency, quality, and customer outcomes.
  
  

What You Will Bring

• 7+ years of experience in cybersecurity operations, Managed Detection and Response, Security Operations Center operations, incident response, or a related discipline, including at least 2 years leading people, teams, or operational functions.

• Demonstrated experience leading security operations in a high-volume, customer-facing environment, with responsibility for staffing, workload management, queue health, prioritization, service levels, quality, and operational outcomes.

• Proven people-leadership experience, including coaching, performance management, career development, hiring, onboarding, and developing effective teams through clear expectations, constructive feedback, and accountability.

• Experience developing Team Leads, senior analysts, or other frontline leaders and building stronger leadership capability within security operations teams.

• Experience operating within a global or 24x7 security operations environment, including effective coordination, escalation, and handover across geographically distributed teams.

• Strong understanding of security operations and the end-to-end lifecycle of triage, investigation, escalation, response, and customer communication.

• Strong technical understanding of endpoint, network, cloud, identity, and security telemetry, with the ability to assess investigation quality, challenge technical conclusions, guide analysts, and make sound risk-based decisions.

• Experience managing operational and customer escalations, with the ability to quickly understand complex situations, establish clear ownership and priorities, coordinate across teams, and communicate effectively with technical and executive stakeholders.

• Experience using operational metrics and data to identify workload, capacity, performance, and quality issues, make informed operational decisions, and deliver measurable improvements.

• Demonstrated ability to improve operational efficiency through process simplification, standardization, automation, or better use of technology while maintaining investigation quality and customer outcomes.

• Strong understanding of attacker tools, tactics, and techniques, including persistence, lateral movement, credential theft, ransomware, and defense evasion, together with working knowledge of the MITRE ATT&CK framework.

• Experience working effectively across functions such as Detection Engineering, Threat Intelligence, Incident Response, Product, Engineering, and customer-facing teams to resolve operational issues and improve security services.

• Strong judgment and decision-making skills, with the ability to effectively balance customer impact, security risk, operational capacity, investigation quality, and business priorities.

• Excellent written and verbal communication skills, with the ability to communicate complex operational and security issues clearly to analysts, technical stakeholders, customers, and senior leaders.

• Relevant professional experience in cybersecurity, security operations, or a related discipline. Formal qualifications and certifications are valued but not required where equivalent experience can be demonstrated.

• Experience leading MDR or security operations teams across Australia and/or the broader APJ region.

• Experience working within global, distributed security operations and collaborating across regions and time zones.

• Experience improving security operations through automation, AI-assisted capabilities, process redesign, or operational transformation.

• Experience partnering with Detection Engineering and other security teams to improve detection quality, reduce unnecessary analyst workload, and strengthen operational effectiveness.

• Relevant cybersecurity or leadership certifications such as CISSP, GCIH, CISM, or equivalent are beneficial but not required.

#LI-Remote
#B2

What does remote mean at Sophos?
Sophos supports flexible ways of working, with many roles offered remotely and others working in a hybrid model. For remote roles, you may work remotely within the location specified in the job posting. Candidates must reside in and be authorized to work in that location. Our teams collaborate across locations and time zones, using technology to stay connected and deliver results.

Our Commitment To You

Sophos welcomes applicants with diverse experiences, perspectives, and backgrounds. We believe great ideas come from different ways of thinking, and we are committed to building a workplace where people can contribute, grow, and succeed.

We evaluate all candidates based on job-related skills, qualifications, and experience, and are committed to providing equal employment opportunities consistent with applicable laws and regulations.

If you require a reasonable accommodation during any stage of the recruitment process, please let your recruiter know. Any information shared will be used only to evaluate and provide the requested accommodation.