Director of Cyber Operations

Our job everyday is to protect the data and critical assets of businesses world-wide by discovering hidden vulnerabilities… before the bad guys do

At CybelAngel, we see beyond perimeters to protect businesses from the most critical cybersecurity threats. Fortune 500 Global to mid-size companies world-wide, trust CybelAngel’s global team of approximately 130 team members to protect their businesses from digital threats. With a combination of advanced machine learning, cyber analysis expertise, and a powerful suite of software solutions, CybelAngel detects and resolves our clients potential threats, long before they can fall into the hands of cyber criminals.

Our capabilities expand every day to uncover new risks, detect more threats, protect more clients, and create new possibilities for our employees.

With employees based in France and in the US, CybelAngel’s global footprint allows for a thriving hybrid, office and remote-work environment. We are looking for exceptional ‘go-getters’ who share our ambitious vision, innovative culture especially considering our GenAI DNA, high commitment to ethics, and enthusiasm for being the best possible place to work

Our values

• Be Bold

• Be Curious

• Stronger Together

We are looking for our Director of Cyber Operations, based in Paris.

The Director of CyberOps runs the department that turns CybelAngel's external threat visibility into actionable intelligence for clients. They bring a SOC operations background and use it to run the analyst team like a modern SOC: industrialized processes, capacity managed on data, clear SLAs and deliverables that plug into clients' SOC toolchains. They also own client integrations and drive innovation on sources and product features.

Your responsibilities

1. Run and industrialize operations

• Structure the run: alert tiering, escalation paths, runbooks and playbooks per sources

• Organize coverage: shifts, weekend on-call and follow-the-sun across EMEA and US

• Own capacity planning: model workload per client, source, and size the team (FTE) accordingly

• Monitor workload and productivity with objective activity data (alert volumes, time per case and per client, backlog, utilization) and rebalance capacity across pods

• Anticipate the FTE impact of new clients, modules and sources before they go live

• Convert automation gains into measured FTE savings and reallocate freed capacity to higher-value work

• Guarantee service quality: SLA, report quality, NPS, cost to serve per client

2. Own client integrations

• Lead the integration of CybelAngel intelligence into clients' SOC, CERT and CSIRT workflows (SIEM, SOAR, EDR/XDR, CTI platforms)

• Standardize integration patterns, connectors and onboarding to cut time-to-value

• Make sure deliverables are directly actionable in client toolchains (formats, enrichment, severity mapping)

3. Drive innovation on sources and product features

• Identify, qualify and onboard new collection sources

• Measure detection coverage and precision, and sponsor improvements (filtering, scoring, enrichment)

• Turn field insights into feature requests, and co-define priorities with Product and Engineering

• Lead prototyping with the Innovation Ops pod with clear success metrics

4. Support the delivery of our Professional Services / Consulting offer

• Allocate analyst capacity from the Investigation & Consulting pod to client services / consulting engagements

• Guarantee delivery quality on those engagements and protect run SLAs while doing it

5. Lead and develop the department

• Manage and coach the three Team Leads; run quarterly performance reviews

• Own the department's organization, roles and career paths (L1 to L5)

• Recruit, develop and retain key CyberOps talent

• Set data handling and ethical standards for sensitive investigations

• Represent CyberOps with client CISOs and SOC managers, and at selected industry events

What success looks like after 12 months

• An industrialized run: tiering, runbooks and on-call coverage in place across all pods

• A capacity model in place: FTE needs are forecast per client and module, and staffing decisions are made on data

• Measurable FTE savings from automation, reinvested in higher-value work

• Standard integration patterns for the main SIEM, SOAR and CTI platforms, with shorter time-to-value

• New sources onboarded and product improvements shipped f