Full-Time
Senior Deal Desk Lead
Posted on 8/19/2026
Halcyon
201-500 employees
Cybersecurity platform enabling automated decryption
Compensation Overview
$175k - $215k/yr
Remote in USA
Remote
 Accounting (1) |
|---|
Get referred to Halcyon
See people who can refer or advise you
- At least 7 years of experience in Deal Desk, Revenue Operations, Sales Operations, Commercial Operations, Finance, or a similar role within a high-growth SaaS or technology company.
- Strong understanding of SaaS and enterprise software deal structures, including pricing, discounting, contract terms, payment structures, renewals, and commercial concessions.
- Demonstrated experience evaluating complex transactions and providing recommendations to sales and executive stakeholders.
- Strong financial and analytical skills with the ability to assess the complete economics of a deal and understand the implications of different commercial structures.
- Experience working within structured approval frameworks and applying defined levels of authority to commercial decisions.
- Strong commercial judgment with the ability to balance customer requirements, revenue objectives, risk, and long-term company value.
- Ability to identify and clearly articulate financial, operational, contractual, and precedent implications associated with deal decisions.
- Demonstrated ability to educate and influence teams, helping stakeholders understand commercial guardrails and their rationale.
- Strong problem-solving skills with the ability to develop alternative deal structures when an initial proposal does not meet established criteria.
- Excellent written and verbal communication skills, including the ability to present complex deal considerations clearly and concisely to senior decision-makers.
- Strong cross-functional collaboration skills with experience partnering across Sales, Finance, Legal, Revenue Operations, Customer Success, and executive leadership.
- High attention to detail and a consistent, disciplined approach to commercial decision-making.
- Ability to operate effectively in a fast-paced environment while managing multiple time-sensitive transactions and competing priorities.
- Serve as the primary point of coordination for the evaluation of complex and non-standard commercial deals.
- Analyze proposed deal structures against established commercial criteria, policies, and approval levels.
- Provide clear, data-informed recommendations on deal exceptions, including the financial, commercial, operational, and long-term implications of proposed terms.
- Ensure deals requiring exceptions are routed to the appropriate decision-makers based on established levels of authority.
- Partner closely with Sales to structure deals that address customer requirements while supporting the company’s commercial objectives.
- Educate sellers, managers, and other stakeholders on deal criteria, approval requirements, pricing principles, and commercial best practices.
- Help teams understand the rationale behind commercial policies and approval decisions so that deal quality improves at the point of creation.
- Evaluate the complete economics and structure of a transaction, including pricing, discounting, contract duration, payment terms, product mix, services, concessions, renewal considerations, and other relevant factors.
- Identify financial, operational, contractual, and precedent risks associated with proposed deal structures.
- Partner with Finance, Legal, Revenue Operations, Customer Success, Sales leadership, and other stakeholders to ensure proposed deals are aligned and executable.
- Provide approvers with concise, objective analysis of exceptions, including the business rationale, risks, trade-offs, alternatives, and recommended path forward.
- Apply established deal criteria consistently while exercising sound business judgment when circumstances require additional consideration.
- Maintain clear documentation of deal reviews, recommendations, approvals, and exceptions.
- Identify recurring deal patterns and exception trends that may indicate opportunities to improve commercial policies, pricing, packaging, processes, or field enablement.
- Use insights from deal activity to improve the quality and consistency of commercial decision-making across the organization.
- Help simplify and improve the deal review experience by identifying opportunities to reduce unnecessary friction and increase speed for deals within established parameters.
- Partner with Revenue Operations and business systems teams to improve the tools, workflows, and data required to support efficient deal evaluation and approval.
- Support the continued evolution of the company’s commercial practices as the company, customer base, product portfolio, and go-to-market strategy scale.
- Experience with customer relationship management, configure-price-quote, contract lifecycle management, and related revenue technology platforms.
Halcyon.ai provides an Anti-Ransomware and Cyber Resilience Platform on a subscription basis to safeguard businesses against ransomware. The platform works by automatically capturing encryption keys and enabling autonomous decryption to instantly recover infected devices, minimizing downtime. It also includes a resilience engine to accelerate system recovery and a Ransomware Readiness Report to help firms assess and improve their security posture. The solution is distinguished by its automatic decryption capability, key capture, and rapid recovery workflow, all embedded in a single platform. The goal is to prevent ransomware disruption, ensure business continuity, and reduce potential losses from cyber threats.
Company Size
201-500
Company Stage
Series C
Total Funding
$210M
Headquarters
Austin, Texas
Founded
2021
Get referred to Halcyon
See people who can refer or advise you
Simplify's Take
What believers are saying
- Beazley Security and Booz Allen Hamilton widened incident-response distribution in 2026.
- HYCU’s March 31, 2026 R-Shield integration expands Halcyon into cloud and hybrid backups.
- Halcyon’s 24/7 Ransomware Operations Center and ransomware warranty reduce buyer fear of downtime.
What critics are saying
- CrowdStrike, Microsoft, and Palo Alto Networks can bundle ransomware controls into broader platforms fast.
- Kernel-level blocking risks false positives, operational friction, and customer rollback if August 2026 macOS support disappoints.
- If Microsoft ships comparable prevention inside Defender, Halcyon becomes a niche feature, not a platform.
What makes Halcyon unique
- July 28, 2026 File Resilience stops encryption at the Windows kernel before files change.
- Halcyon’s rollback captures ransomware key material, decrypting files without backups or shadow copies.
- Dell Trusted Workspace and Microsoft Defender integrations embed Halcyon into existing enterprise workflows.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Health Insurance
Dental Insurance
Vision Insurance
401(k) Retirement Plan
401(k) Company Match
Unlimited Paid Time Off
Parental Leave
Company Equity
Growth & Insights and Company News
6 month growth
↑ 13%1 year growth
↑ 16%2 year growth
↑ 20%New file resilience tool stops ransomware before files are encrypted. August 4, 2026 Halcyon has launched File Resilience, a new capability that stops ransomware encryption before files are modified. Operating at the Windows kernel level, it monitors the sequence of actions ransomware must take to encrypt data and terminates the process as the attack begins. Halcyon said the approach is designed to work against known ransomware variants as well as previously unseen attacks that may not have an existing signature. Once an encryption attempt is blocked, the company's 24/7 Ransomware Operations Center investigates the incident, contains the threat, and works to remove the attacker from the environment. Moving ransomware defense ahead of recovery. File Resilience adds a preventive layer to Halcyon's existing ransomware recovery capabilities. The company's rollback technology captures encryption key material during an attack and uses it to decrypt affected files directly, rather than relying on backups or shadow copies that attackers may delete. Seth Geftic, Halcyon Head of Marketing at Halycon told MSSP Alert, "Halcyon's existing rollback doesn't use backups. It captures the ransomware's encryption key material during the attack and uses it to decrypt files directly. But it's still reactive. Recovery happens after encryption, and without eviction, the attackers are still on the network and can simply re-encrypt the device." File Resilience is designed to act earlier in the attack. According to Halcyon, it serves as the first layer in a three-part approach that stops encryption, limits the blast radius, and captures key material for recovery. "File Resilience sits earlier, with kernel-level, real-time detection that stops encryption as it happens," Geftic said. "Key capture and decryption remain the safety net behind it, with no backups required either way." The shift matters because encryption is often the point where a ransomware incident turns into a business disruption. Stopping that process can keep systems and files available while responders investigate how the attacker entered the environment and what access remains. Microsoft integrations bring response into existing workflows. Halcyon also announced native macOS support, scheduled for general availability in August, along with expanded integrations for Microsoft Defender and Microsoft Sentinel. The Microsoft integrations are available now and are designed to bring Halcyon alerts and response activity into security workflows that customers already use. For Microsoft Defender customers, Halcyon continuously monitors the health and integrity of the endpoint security platform, including attempts to disable or bypass it. Halcyon can also trigger Defender response actions, such as isolating a compromised host. "Halcyon backstops Defender itself," Geftic said. "If Defender is tampered with or disabled, Halcyon keeps detecting and blocking ransomware independently." The Defender integration also allows analysts in Halcyon's Ransomware Operations Center to isolate Defender-managed assets directly from the Halcyon console during an active incident. That can reduce the need to move between separate security tools while an attack is underway. The Sentinel integration sends Halcyon events and alerts into Microsoft Sentinel in near real time. The data is mapped to Microsoft's Advanced Security Information Model, allowing security teams to query it using Kusto Query Language and incorporate it into existing investigations, analytics and response workflows. The integrations allow customers to add Halcyon without replacing their Microsoft security tools. Halcyon can operate alongside Defender and Sentinel while adding controls focused specifically on ransomware encryption, recovery, and response. Blocking encryption does not end the attack. Preventing file encryption addresses one part of a ransomware incident. Attackers may still have stolen data, gained privileged access, or established persistence elsewhere in the network. Halcyon said its Data Exfiltration Protection capability operates continuously to detect and stop potential data theft, including activity identified through DNS and volumetric monitoring. "Once encryption is blocked, the attacker may still have stolen data or gained privileged access," Geftic said. "Our Data Exfiltration Protection runs 24/7 to identify and halt potential exfiltration, with an immediate investigation when suspicious activity is detected." Halcyon's eviction workflows run alongside forensic investigations and are designed specifically for ransomware incidents. The company said the workflows automate containment tasks, allowing responders to spend more time examining the cause of the breach, identifying affected systems and removing the attacker's access. "The Halcyon ROC investigates and disrupts the attack, leads recovery and works to fully evict the attacker," Geftic said. "That includes decrypting affected data using captured key material when files have already been encrypted." By pairing kernel-level blocking with Microsoft integrations, data exfiltration monitoring and human-led response, Halcyon is trying to reduce both the operational damage of ransomware and the time required to remove an attacker from the environment. However, the broader value of File Resilience will depend on whether it can stop encryption without disrupting legitimate activity and whether security teams can move quickly from prevention to full containment. An in-depth guide to ransomware. Get essential knowledge and practical strategies to protect your organization from ransomware attacks. Suparna is the Senior Managing Editor for CyberRisk Alliance's Channel Brands, including MSSP Alert and ChannelE2E. She manages content development, sharpens editorial workflows, and ensures storytelling is tightly aligned with audience needs. With a background in technology, media, and education, she combines strategic insight with creative execution.
Beazley Security and Halcyon have launched the Cyber Resilience Retainer, combining incident management, incident response, and ransomware resilience in a single offering. The retainer provides comprehensive support before, during, and after cyber incidents, moving beyond traditional incident response contracts that focus primarily on post-attack investigation. The service gives organisations access to cyber breach coaches, digital forensics experts, recovery specialists, and ransomware defence professionals through a single point of contact. Halcyon's contribution includes ransomware identification, containment, prevention of further encryption, and recovery support backed by its Ransomware Operations Centre. The retainer aims to eliminate procurement delays during crises by establishing relationships and response processes beforehand, enabling faster coordination and improved recovery outcomes.
Halcyon has launched File Resilience, a capability that prevents ransomware encryption by terminating attempts at the Windows kernel level before files are modified. The technology intercepts encryption attempts as they begin, removing attackers' primary leverage for extortion. The company is also introducing native macOS support, available in August, and deeper integrations with Microsoft Defender and Microsoft Sentinel. These additions extend ransomware protection across Windows, macOS, and Linux environments. When File Resilience blocks an encryption attempt, Halcyon's 24/7 Ransomware Operations Centre investigates and evicts the threat actor. Unlike traditional security tools that focus on detection or post-attack recovery, File Resilience is designed to stop encryption whilst it's happening. File Resilience is available immediately as part of Halcyon's ransomware resilience platform.
Halcyon launches File Resilience, preventing ransomware encryption before it starts. Halcyon Team Published on Jul 28, 2026 New capability makes it virtually impossible for ransomware operators to encrypt files, alongside native macOS support and deeper Microsoft Defender and Microsoft Sentinel integrations San Diego, CA - July 28, 2026 - Halcyon, the ransomware resilience platform, today announced File Resilience (FiRe), a new capability that prevents ransomware encryption before files are modified. By terminating encryption attempts at the Windows kernel level, File Resilience removes the primary mechanism ransomware operators use to extort organizations and helps keep businesses running through an attack. File Resilience introduces a fundamentally different approach to ransomware protection by preventing encryption rather than detecting or recovering from it after the fact. Operating at the Windows kernel level, it intercepts ransomware encryption attempts the moment they begin, making successful encryption virtually impossible and eliminating the attacker's primary source of leverage. Today's announcement also expands the Halcyon platform with native support for macOS and deeper integrations with Microsoft Defender and Microsoft Sentinel, extending ransomware resilience across modern enterprise environments while enabling organizations to leverage the security operations workflows they already use. "Everything we build at Halcyon is guided by one goal: making ransomware a non-event for our customers. We're continuously expanding our ransomware resilience platform to help organizations stay operational no matter how the threat evolves. With File Resilience, expanded macOS support, and deeper Microsoft integrations, we're making malicious encryption virtually impossible while making it even easier to deploy Halcyon across modern enterprise environments." - Scott Stout, President, Halcyon Unlike traditional security tools that focus on detection or recovery after encryption has occurred, File Resilience is purpose-built to stop ransomware encryption as it's happening. Operating at the Windows kernel level, it monitors for the behavioral sequence every ransomware variant must execute and terminates encryption attempts before files are modified, protecting against both known and previously unseen ransomware. When an encryption attempt is prevented, Halcyon's 24/7 Ransomware Operations Center (ROC) investigates, contains, and evicts the threat actor, helping organizations quickly return to normal operations. File Resilience is available immediately as part of the Halcyon ransomware resilience platform. Native macOS support will be generally available in August, while enhanced Microsoft Defender and Microsoft Sentinel integrations are available today, extending ransomware resilience across Windows, macOS, and Linux while making it easier for organizations to deploy Halcyon within existing security operations. Halcyon will showcase File Resilience, native macOS support, and enhanced Microsoft Defender and Microsoft Sentinel integrations at Black Hat USA 2026. Visit Booth 4195 to see the platform in action and learn how Halcyon prevents ransomware encryption before it disrupts operations: https://www.halcyon.ai/black-hat-2026 About Halcyon Ransomware will come for your business. Halcyon makes sure it doesn't win. Halcyon is the dedicated ransomware resilience platform built to stop attacks your existing tools were never designed to catch and recover in minutes if something gets through. Turning what could have been a business-ending event into a non-event. halcyon.ai Media Contact Olivia Francis Global Communications
Halcyon, an anti-ransomware platform provider, has appointed former US Secretary of Homeland Security Kirstjen Nielsen and former US National Cyber Director Chris Inglis as strategic advisers. The pair will counsel Halcyon's leadership on cybersecurity strategy, national security trends and public-private sector collaboration. Nielsen, who led the Department of Homeland Security with over 250,000 personnel and a $75 billion budget, helped establish the Cybersecurity and Infrastructure Security Agency. She now runs Lighthouse Strategies, advising on cybersecurity and risk management. Inglis served as America's first National Cyber Director and spent nearly three decades at the National Security Agency, including eight years as deputy director. The appointments strengthen Halcyon's advisory network as it expands globally.