Security & Threat Operations Manager

About Us

DriveWealth is on a mission to make investing easier. We are a global B2B financial technology organization dedicated to democratizing access to financial independence around the world. Our mission is realized through an API-based platform, empowering our partners to offer seamless investing and trading experiences to clients worldwide, all from their mobile devices.

There's never been a better time to build a category-defining business. Our culture blends the pace and agility of a fintech start-up with the impact, stability, and discipline of Wall Street.

About the Role

DriveWealth LLC is seeking a highly motivated and experienced Security & Threat Operations Manager to build and mature the function protecting our brokerage platform and corporate environment. Reporting to the Chief Information Security Officer, you will grow and lead the team, establish its operating model and roadmap, and deliver measurable improvements in threat detection, investigation, incident response, and exposure management.

In this hands-on leadership role, you will own detection content and the exposure management lifecycle, security monitoring and incident response, operation and tuning of security controls, and turn threat intelligence into defensive improvements. You will act as Incident Commander during significant security incidents.

What You'll Do

• Program Development: Mature Security & Threat Operations through a measurable roadmap, operating model, monitoring coverage, escalation procedures, and service provider oversight.
• Team Development: Grow and lead the team through hiring, coaching, training, career development, and performance management.
• Detection Engineering: Own the detection program incorporating threat intelligence, content development, proactive hunting, and validation through attack simulations and purple-team exercises.
• Monitoring & Investigation: Own security monitoring and investigation across product and corporate environments, including phishing, malware, credential compromise, API abuse, DDoS, and insider threats.
• Digital Risk Monitoring: Own digital risk monitoring covering external attack surfaces, leaked credentials, exposed data, impersonation, phishing domains, and takedown coordination.
• Automated Response: Partner with Security Engineering to build pre-defined automated security response actions and coordinate with business leaders on response actions that cannot be automated.
• Incident Management: Own the incident response lifecycle as Incident Commander, including preparedness, forensic evidence handling, containment, recovery validation, regulatory coordination, and post-incident improvement.
• Exposure Management: Own the exposure management lifecycle from discovery through verified closure, coordinating remediation with system and product owners.
• Control Operations: Own the operation and tuning of security controls such as DLP, WAF, email filtering, and identity compromise prevention.
• Regulatory Controls: Partner with Legal, Compliance, Security Engineering and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-3 and 17a-4 controls.
• Control Assurance: Automate control validation and evidence collection, support audits and regulatory examinations, and drive remediation of technical findings.

You Bring

• 8+ years in security operations, detection engineering, incident response, or related disciplines, including 3+ years managing technical teams.
• Demonstrated experience serving as Incident Commander during significant security incidents.
• Strong hands-on expertise in threat intelligence, detection content development, SIEM and endpoint analytics, investigation, threat hunting, and defensive validation.
• Practical scripting or query skills in Python, SQL, or comparable languages.
• Working knowledge of AWS, Kubernetes, API security, identity, and Windows/macOS endpoint telemetry. Experience with production environments with demanding availability and latency requirements is preferred.
• Experience creating, operating, and tuning preventive controls such as DLP, WAF, and email filtering.
• Experience investigating insider threats and digital risks.
• Strong people leadership, process design, and prioritization skills, with support for on-call escalation outside normal business hours.
• Familiarity with NIST CSF, incident response practices, and MITRE ATT&CK. Experience in regulated financial services, including SEC/FINRA environments, is preferred.
• Bachelor's degree in a related field or equivalent practical experience. Certifications such as CISSP, GCIH, GCIA, or GCFA are a plus.

Location

This role is open to candidates in New York City, Chicago, Austin, Dallas, Denver, Miami, San Francisco Bay Area, or Seattle.

• New York or Chicago based: expected to come into the office on a cadence set by the Hiring Manager/Team.
• Austin, Dallas, Denver, Miami, San Francisco, or Seattle based: fully remote, with occasional visits to onsite offices.
• Applicants must be authorized to work for any employer in the U.S. DriveWealth does not sponsor employment visas at this time.

Pay Range: $200,000 – $250,000 USD

Compensation

Pay is generally based on the level, complexity, responsibility, location, and job duties of the specific position. This role is eligible for base, bonus, equity, 401(k) match, and benefits and perks.

Benefits

Competitive compensation, equity, and a 401(k) match. Medical, dental, vision, and disability insurance, Paid Parental Leave, wellness reimbursement, a company-provided phone, a personal development allowance, Paid Time Off (PTO), and observed holidays.

Equal Employment Opportunity

DriveWealth is an equal opportunity employer and does not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.