Senior Manager - Security Operations

• Own SEIM end to end: design, deployment, priority log onboarding, detection content, tuning, and ongoing cost management.
• Own and enforce a log coverage standard spanning cloud, SaaS, endpoint, network, application and laboratory environments, and close the gaps where coverage does not exist today.
• Manage the 24x7 MDR provider. Own the service levels, the escalation path into SiTime, the quality review cycle and the operating rhythm.
• Build detection use cases aligned to the threats that matter to a fabless semiconductor company, including unauthorized access to and bulk movement of design data and source code.
• Establish alert triage, case management and hand-off workflow between the MDR provider and SiTime Security; measure and drive down time to acknowledge and time to contain.
• Set log retention standards sufficient to support forensic investigation, legal hold and customer or regulatory inquiry.
• Partner with Security Engineering on the coverage, configuration health and alert quality of CrowdStrike, Darktrace, Microsoft Defender and future sensors.

Threat Hunting, Intelligence and Detection Improvement

• Run a threat hunting program, directly and through the MDR provider, focused on the adversary tradecraft used against semiconductor, hardware and intellectual property targets.
• Track threat intelligence relevant to SiTime, including state-linked activity, and turn it into detection content and hunting hypotheses.
• Map detection coverage to MITRE ATT&CK, and to MITRE ATLAS for AI systems and agents, and close the highest-risk gaps first.
• Participate in purple team exercises with Offensive Security, and convert every missed technique into a tested detection.
• Provide exploitation and threat signal to Vulnerability Management, and partner on the vulnerability response playbook and tabletop exercises for critical vulnerabilities and zero-days.
• Produce detection and response metrics that demonstrate risk reduction rather than alert volume.

• Design and operate a risk-based vulnerability management program across endpoints, servers, cloud workloads, SaaS, network devices and laboratory systems.
• Define remediation service levels by severity and asset criticality, and drive closure with IT, Engineering and system owners rather than reporting on open counts.
• Own attack surface and external exposure monitoring of internet-facing assets, and reduce the exposed footprint over time.
• Operate exception handling with risk-based approval, compensating controls and time-boxed expiry, in partnership with the Security Risk, Assurance and Trust function.
• Produce vulnerability, coverage and aging metrics that demonstrate risk reduction rather than scan activity.
• Feed vulnerability and exposure signal into the enterprise risk register so it shapes company-wide prioritization.

• Own the incident response and ransomware playbooks, and keep them approved, socialized and exercised.
• Deploy and operate paging, the on-call rotation and escalation, and make sure a real person is reachable at any hour.
• Manage the external incident response and digital forensics retainer, and keep the partner current on the SiTime environment.
• Plan and run ransomware and crisis tabletop exercises for both executive and technical audiences, and track every resulting action to closure with evidence.
• Act as incident commander for security incidents: run the bridge, set the status cadence, and produce the executive reporting.
• Partner with Legal, Communications, Finance and Insurance on notification obligations, crisis communications and claims.
• Run post-incident reviews and feed the findings back into detection content, controls and the security roadmap.

• 8+ years in security operations, detection and response, or vulnerability management, including 3+ years building or substantially rebuilding a function.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field — or equivalent practical experience.
• At least one of the following certifications: CISSP, GCIA, GCIH, GCFA, or equivalent.
• People leadership experience.
• Hands-on experience deploying and operating a modern SIEM, Microsoft Sentinel strongly preferred, including log onboarding, detection engineering and cost control.
• Experience managing an MDR or MSSP relationship, including service level definition, escalation design and quality review.
• Demonstrated ownership of a risk-based vulnerability management program with enforced remediation service levels.
• Experience leading security incidents end to end, including ransomware scenarios, and designing and running tabletop exercises.
• Experience running threat hunting and mapping detection coverage to MITRE ATT&CK and ATLAS.
• Technical fluency across cloud platforms (Azure, AWS), endpoint, network and identity telemetry.
• English proficiency is required, including the ability to effectively communicate, collaborate, and perform job responsibilities in a professional business environment.

• Experience in a semiconductor, hardware, or other fabless/manufacturing environment, or another regulated hardware/OT-adjacent industry.
• Hands-on experience with industry leading security tools and scanner
• Experience monitoring engineering, design and laboratory environments, including intellectual property exfiltration scenarios.