Senior Manager, Security Operations Center

About the team:

The Information Security organization advances the overall state of security at Rubrik through critical initiatives and coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our assets, provides awareness education to teams on security best practices for data protection, and ensures data governance and data sharing relationships with third parties in order to securely protect Rubrik information.

About the role:

Rubrik is hiring a Senior Manager to lead our Security Operations Center, including our FedRAMP-authorized environment. Incident response sits at the core of what the SOC does, alongside detection and monitoring, and this role owns all of it. You'll inherit a SOC that has already grown a lot in scale and maturity, and your job is to take it further: stronger detection and incident response, broader coverage as our environment gets more complex, and a real strategy for AI in the SOC.

Driving our AI SOC transformation is a core part of this role. You'll be the one setting the strategy for how AI enables the SOC: scaling coverage beyond what headcount alone could support, reducing alert fatigue on L1 analysts, and giving analysts more room to focus on complex investigations and incident response.

You'll also own SOC leadership for our FedRAMP environment: same detection, incident response, and operational rigor, applied to the teams and processes inside that compliance boundary.

What you'll do:

Team Leadership & Development-

• Hire, train, mentor, and evaluate SOC analysts across both commercial and FedRAMP-scoped teams.
• Build a culture of collaboration, ownership, and continuous learning within the SOC.
• Keep an eye on signal quality and analyst experience so analysts are working real alerts, not chasing noise.
• Develop career paths, training programs, and succession planning for SOC analysts.

Monitoring & Incident Response-

• Direct 24/7 monitoring and make sure coverage stays consistent across shifts and regions.
• Serve as Incident Manager for major security incidents, leading the response and collaborating across InfoSec teams as needed during investigations.
• Drive continuous improvement of SOC processes, including incident response playbooks, runbooks, and escalation procedures.
• Make sure incident response processes hold up to the extra rigor FedRAMP requires.

AI SOC Strategy & Tooling-

• Own the roadmap for AI-enabled SOC capabilities: AI-assisted triage, investigation support, response automation.
• Deploy AI/ML and automation to cut down L1 toil and alert fatigue, so analysts spend more time on complex investigations.
• Work with Threat Operations and Security Engineering to evaluate, pilot, and roll out AI SOC tools.
• Enable the safe use of AI tools internally, while building the SOC's ability to detect and defend against AI-enabled threat actors.

Detection Tuning & Coverage Expansion-

• Partner with Threat Operations to grow detection maturity and expand coverage as the Rubrik environment grows (cloud, SaaS, on-prem, and FedRAMP systems).
• Work with Threat Operations to close detection gaps, cut false positives, and keep detections aligned to current threat intel and MITRE ATT&CK.
• Feed incident findings back to Threat Operations to drive continuous improvement of detection logic.
• Close the loop with Security Engineering to bring in additional logging based on incident and investigation data.

Strategy & Operations Management-

• Set the direction and operating model for a modern SOC.
• Own planning, budgeting, staffing, and resource allocation, including for the FedRAMP-scoped team.
• Track and report on key metrics like MTTD (mean time to detect) and MTTR (mean time to respond), analyst workload, and detection coverage.
• Keep evolving the operating model as the company scales.

Tool & Technology Evaluation-

• Make the strategic calls on SIEM/SOAR platforms and automation.
• Own the SOC's technology roadmap, including build-vs-buy decisions, vendor evaluation, and integration with the broader security stack.

Executive Reporting & Stakeholder Communication-

• Give the CISO and executive leadership regular updates on security posture, SOC performance, and notable threats.
• Represent the SOC in cross-functional and executive settings, translating technical detail into business risk.

Compliance & Audits-

• Support FedRAMP and other security audits: evidence collection, control validation, remediation tracking for the SOC's scope.
• Build and maintain compliance and operational hygiene reporting for both commercial and FedRAMP environments.
• Make sure SOC processes and documentation hold up to regulatory and contractual requirements.

Experience you'll need:

• 8+ years in security operations, incident response, or a related field, including prior experience leading a SOC, incident response included, in a management or senior lead role.
• Experience serving as an Incident Manager, leading incident investigations and coordinating across teams under pressure.
• Experience building or maturing a SOC operating model: 24/7 coverage, playbooks, escalation processes.
• Hands-on background in detection and response, with real fluency in SIEM/SOAR platforms and common attacker tactics and techniques (MITRE ATT&CK).
• Experience managing and developing SOC analysts, including hiring, mentoring, and performance management.
• A track record of defining and reporting SOC metrics (MTTD, MTTR, coverage, etc.) to both technical and executive audiences.
• Experience supporting compliance frameworks and audits (FedRAMP, SOC 2, ISO 27001, or similar). Direct FedRAMP experience is a strong plus.
• Strong communication skills and comfort briefing executive leadership and cross-functional stakeholders on posture and incidents.
• Must be a U.S. citizen, as required for FedRAMP responsibilities.

Preferred qualifications:

• Direct experience evaluating, piloting, or rolling out AI/ML-driven security tooling: AI-assisted triage, automated investigation, GenAI copilots for SOC work, and similar.
• Experience operating within or leading a FedRAMP-authorized security function.
• Comfort with cloud-native and SaaS environments in addition to traditional on-prem infrastructure.
• Certifications like GCIH, GCFA, CISSP, or CISM are a plus.

What Success Looks Like-

• Detection and response keep maturing while coverage expands across a growing environment.
• Alert fatigue and manual triage on L1 analysts drop, thanks to real AI SOC tooling adoption.
• MTTD/MTTR trends improve, and analyst retention and satisfaction go up with them.
• FedRAMP SOC operations stay clean and audit-ready, with no material findings tied to SOC process gaps.
• A strong bench of SOC analysts, with a clear path for future leaders to grow into.