Director, Security Operations

About Accelerant

Accelerant is a data-driven risk exchange connecting underwriters of specialty insurance risk with risk capital providers. Accelerant was founded in 2018 by a group of longtime insurance industry executives and technology experts who shared a vision of rebuilding the way risk is exchanged – so that it works better, for everyone. The Accelerant risk exchange does business across more than 20 different countries and 250 specialty products, and we are proud that our insurers have been awarded an AM Best A- (Excellent) rating. For more information, please visit www.accelerant.ai.

Accelerant is hiring a Director, Security Operations: a senior team lead who owns the work that calls for security judgment and will report directly to the Chief Information Security Officer (CISO). This is a senior, hands-on role: you set technical direction for the security operations team, stay close to the work, and act as the CISO’s trusted deputy for technical security and security operations, including changes in the threat landscape, vulnerabilities and incidents.

You are responsible for the strategic direction of our technical security operations, controls and processes. That includes assessing the security of mergers and acquisitions, owning the penetration test cycle, coordinating purple team exercises and SOC coordination, and acting as the technical expert for projects. You’ll have the autonomy to drive technical initiatives from concept to delivery.

Key responsibilities

The Director, Security Operations owns the high-judgment security work and is accountable for results in five areas.

M&A security

•Lead security due diligence and post-close integration assessments as deal volume grows.

•Build and maintain a repeatable integration playbook: assessment checklist, risk scoring, remediation plan and day-one controls.

•Write clear risk narratives and recommendations for the CISO and deal teams.

Testing, detection and operations

•Lead the penetration test cycle: scoping, triage, remediation tracking and reporting to leadership.

•Own the SOC sync across Accelerant and Mission US/UK: shared priorities, escalation paths, handoffs and coverage gaps.

•Own the detection platform strategy, including Microsoft Sentinel cost and ingestion, without losing detection coverage.

Incident response and control improvement

•Act as incident response manager for technical incidents, leading the response from triage through to resolution.

•Own the technical incident response playbooks and keep them current.

•Lead lessons-learned reviews after incidents and recommend control changes, tracked through to completion.

•Run control reviews and recommend improvements where gaps appear.

•Act as the internal escalation point for the external SOC, advising on potential incidents that need more judgment.

Technical leadership and vendors

•Build and lead the security engineering team: partner with the CISO to hire direct reports, then provide line management and technical direction, including assigning work, reviewing output and coaching.

•Manage the security tooling and service vendors in this area, including the full vendor lifecycle: selection, renewals, performance and escalations.

•Step into hands-on engineering and investigation work when the team needs it.

Required qualifications

Candidates typically bring 6 to 9 years of security engineering experience.

•Breadth across cloud security, network security and detection engineering, with depth in Azure and Microsoft Sentinel.

•Experience leading incident response for technical incidents, including post-incident reviews.

•Experience assessing the security of acquisitions.

•Familiarity with modern identity and authentication, including passkeys and privileged access.

•Experience hiring, line-managing and developing security engineers.

•Able to write a clear risk narrative and present it to leadership.

•Sound judgment on ambiguous problems, and good prioritization across competing demands.

•Experience managing security vendor relationships.

•Willing to stay close to the technical work: this is not a pure management role.

Preferred qualifications

These strengthen an application but are not required. Prior exposure to M&A security integration is the strongest differentiator.

•Experience assessing acquisition targets or integrating acquired companies, including building repeatable playbooks.

•Experience running a recurring penetration testing or automated pentest program and driving remediation.

•Experience coordinating a SOC or managed detection provider across multiple entities or regions.

•Experience with Microsoft Sentinel and SIEM cost optimization.

•Experience securing AWS environments and working with Cloudflare.

•Experience rolling out phishing-resistant authentication such as passkeys or FIDO2.

•Certifications such as CISSP, CISM, GIAC, AZ-500 or SC-200.

•Experience in insurance, financial services or another regulated industry.