LastPass is looking for a Director, Security Operations:

In this role, you will own the strategy, operations, and continuous evolution of LastPass's Security Operations. You will set the direction for how LastPass detects, responds to, and recovers from security incidents - translating threat intelligence into a mature, high-performing program that shapes the company's security posture and protects customer trust.

About the team:

The Security Operations team is the frontline of LastPass's security - responsible for detecting threats, leading investigations, and driving incident response across the full technology estate. We are a globally distributed team combining deep technical expertise with a strong culture of collaboration, continuous improvement, and AI-assisted tooling to operate at speed and scale.

If you are passionate about complex problem solving and motivated by scale, then this is the role for you!

Who will you work with?

As Director of Security Operations, you will partner closely with the CISO, Platform and Software Engineering, Cloud Security, Cyber Defence team, GRC, Legal, and Communications teams. Externally, you will engage with vendors, threat intelligence partners, industry CERTs, and law enforcement as needed. You will also manage and develop a team of experienced Response Analysts.

What are some of the exciting challenges you will be working on?

• Own and drive the strategy, roadmap, and maturation of LastPass's Security Operations function - translating the threat landscape into a multi-year program plan that scales with the business
• Lead all response operations across the full incident lifecycle, from detection and triage through containment, eradication, recovery, and post-incident review
• Build, develop, and retain a high-performing team of analysts and engineers - setting clear performance expectations, career development pathways, and a culture of operational excellence
• Partner with the CISO, Legal, and Communications to manage high-severity incidents, coordinating executive response and fulfilling regulatory notification obligations
• Define and own detection and response program metrics, SLAs, and reporting frameworks - providing the CISO and board with clear, evidence-based visibility into program maturity and risk posture
• Champion the integration of AI-assisted triage, automation pipelines, and Detection-as-Code methodologies to reduce analyst toil and drive down mean-time-to-respond
• Establish and maintain strategic relationships with external partners - including threat intelligence vendors, law enforcement, and industry information-sharing groups — to strengthen LastPass's situational awareness
• Collaborate across Business Technology, Cloud Security, and Platform Engineering to ensure cohesive detection coverage and coordinated response capability across the full technology estate

What does it take to work at LastPass?

• Proven experience in security operations, including senior leadership ownership of an incident response or cyber defense function at scale
• Proven ability to build, lead, and develop high-performing security teams - including managing through managers - in a fast-paced, high-stakes environment
• Advanced, hands-on knowledge of the CSIRT/SOC discipline: digital forensics, threat intelligence, malware analysis, network analysis, or incident handling across cloud-native and hybrid infrastructure
• Expert-level command of security frameworks including MITRE ATT&CK, NIST CSF, and the SANS incident response lifecycle, with demonstrated application in real-world program design
• Proven track record of engaging executive leadership, legal counsel, and external stakeholders during major security incidents, including regulatory and board-level communication
• Strategic thinker who can translate complex threat landscapes into clear program priorities and communicate risk in business terms to non-technical audiences
• Operates with calm authority under pressure - able to drive decisive, coordinated action during high-severity incidents while sustaining team morale and stakeholder confidence
• Builds influence across organizational boundaries, driving security outcomes through cross-functional alignment without relying on positional authority

It's great, but not required:

• Experience in the password management, identity security, or SaaS security product domain
• Background in red team operations, adversary simulation, or threat hunting as a complement to defensive program leadership
• Proficiency in Python or PowerShell to drive automation and accelerate detection and response workflows, or experience managing teams and programs who perform these functions