Director of Cyber Operations

Our job everyday is to protect the data and critical assets of businesses world-wide by discovering hidden vulnerabilities… before the bad guys do!

At CybelAngel , we see beyond perimeters to protect businesses from the most critical cybersecurity threats. Fortune 500 Global to mid-size companies world-wide, trust CybelAngel’s global team of approximately 130 team members to protect their businesses from digital threats. With a combination of advanced machine learning, cyber analysis expertise, and a powerful suite of software solutions, CybelAngel detects and resolves our clients potential threats, long before they can fall into the hands of cyber criminals.

Our capabilities expand every day to uncover new risks, detect more threats, protect more clients, and create new possibilities for our employees.

With employees based in France and in the US, CybelAngel’s global footprint allows for a thriving hybrid, office and remote-work environment. We are looking for exceptional ‘go-getters’ who share our ambitious vision, innovative culture especially considering our GenAI DNA, high commitment to ethics, and enthusiasm for being the best possible place to work!

Our values

• Be Bold

• Be Curious

• Stronger Together

We are looking for our Director of Cyber Operations , based in Paris.

The Director of CyberOps runs the department that turns CybelAngel's external threat visibility into actionable intelligence for clients. They bring a SOC operations background and use it to run the analyst team like a modern SOC: industrialized processes, capacity managed on data, clear SLAs and deliverables that plug into clients' SOC toolchains. They also own client integrations and drive innovation on sources and product features.

Your responsibilities

1. Run and industrialize operations

• Structure the run: alert tiering, escalation paths, runbooks and playbooks per sources

• Organize coverage: shifts, weekend on-call and follow-the-sun across EMEA and US

• Own capacity planning: model workload per client, source, and size the team (FTE) accordingly

• Monitor workload and productivity with objective activity data (alert volumes, time per case and per client, backlog, utilization) and rebalance capacity across pods

• Anticipate the FTE impact of new clients, modules and sources before they go live

• Convert automation gains into measured FTE savings and reallocate freed capacity to higher-value work

• Guarantee service quality: SLA, report quality, NPS, cost to serve per client

2. Own client integrations

• Lead the integration of CybelAngel intelligence into clients' SOC, CERT and CSIRT workflows (SIEM, SOAR, EDR/XDR, CTI platforms)

• Standardize integration patterns, connectors and onboarding to cut time-to-value

• Make sure deliverables are directly actionable in client toolchains (formats, enrichment, severity mapping)

3. Drive innovation on sources and product features

• Identify, qualify and onboard new collection sources

• Measure detection coverage and precision, and sponsor improvements (filtering, scoring, enrichment)

• Turn field insights into feature requests, and co-define priorities with Product and Engineering

• Lead prototyping with the Innovation Ops pod with clear success metrics

4. Support the delivery of our Professional Services / Consulting offer

• Allocate analyst capacity from the Investigation & Consulting pod to client services / consulting engagements

• Guarantee delivery quality on those engagements and protect run SLAs while doing it

5. Lead and develop the department

• Manage and coach the three Team Leads; run quarterly performance reviews

• Own the department's organization, roles and career paths (L1 to L5)

• Recruit, develop and retain key CyberOps talent

• Set data handling and ethical standards for sensitive investigations

• Represent CyberOps with client CISOs and SOC managers, and at selected industry events

What success looks like after 12 months

• An industrialized run: tiering, runbooks and on-call coverage in place across all pods

• A capacity model in place: FTE needs are forecast per client and module, and staffing decisions are made on data

• Measurable FTE savings from automation, reinvested in higher-value work

• Standard integration patterns for the main SIEM, SOAR and CTI platforms, with shorter time-to-value

• New sources onboarded and product improvements shipped from CyberOps field input

• Team Leads autonomous on their pod, with SLA and quality targets met across the department

Your preferred experience

Must Have

• 8 to 12 years in cybersecurity, with solid hands-on experience in a SOC, CERT or MSSP (analyst, lead, then manager)

• 3+ years of team management, including managing managers or team leads

• Track record of structuring or industrializing a run team: tiering, runbooks, on-call, SLA management

• Workload modeling and capacity planning for an analyst or delivery team

• Working knowledge of the SOC toolchain, with hands-on experience across several of these categories:

  • SIEM: Splunk, Microsoft Sentinel, IBM QRadar, Elastic

  • SOAR: Palo Alto Cortex XSOAR, Splunk SOAR, Tines

  • EDR / XDR: CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR, Palo Alto Cortex XDR, Sekoia.io

  • CTI platforms: MISP, OpenCTI, Recorded Future or equivalent

• Good command of CTI frameworks (MITRE ATT&CK, Diamond Model)

• Experience running automation or AI projects in an operations team

• Budget ownership for a team or service

• Fluent French and English

Nice-to-have

• Experience in an MSSP or a cyber product company, ideally a scaling B2B SaaS

• Experience integrating threat intelligence feeds into client SIEM/SOAR environments

• Certifications: GIAC (GCIH, GCTI, GCIA), CISSP, ITIL

Soft skills

• Practitioner-leader: credible with analysts because they have done the job, credible with CISOs because they speak their language

• Industrializer: turns individual know-how into processes, runbooks and repeatable standards

• Data-driven operator: manages capacity and priorities with numbers, not intuition

• Accountable: builds a culture of ownership and makes high-stakes calls with sound judgment

• Close to the field: reviews cases, joins key client meetings, keeps technical depth

• Curious and humble: comfortable in a scaling company where processes are still being built

At CybelAngel, we value diverse backgrounds. We encourage all qualified people to apply, regardless of origin, gender, gender identity or expression, sexual orientation, disability, age or beliefs.

Our Benefits

Fixed gross salary between €70K and €80K, depending on experience and the impact demonstrated throughout the recruitment process,

Bonus, based on company and individual performance

Offices at Porte de Clichy (Paris 17 / Batignolles, metro lines 13 and 14, tram).

Swile card for meal vouchers (€8 per day).

‍⚕️ Company-subsidized health insurance, open to all family situations.

Flexible remote work: up to 2 days per week after 1 month with the company.

️ 5 weeks of paid leave plus 8 to 10 RTT days for a better work-life balance.

️ €25 in monthly credits through our works council (CSE) for cultural, sports or leisure activities.

Attractive referral bonuses, up to €2,000 per hire.

Funding for one sports event per year (race, hike, etc.).

️ Remote work allowance to help you set up a comfortable home workspace.

⚖️ Access to a free, confidential legal and administrative support platform.

We are committed to creating an inclusive workplace and giving everyone an equal opportunity to succeed, regardless of their background, identity, or life experiences. We value diversity and believe that every individual, no matter their journey, deserves a chance to contribute and thrive.

Your hiring journey with us

1. Exploratory call (30 min) with Romain, Talent Acquisition Manager. We talk about your background, what you are looking for next and how CybelAngel works, and we share the context of the role.

2. Role deep-dive (45 min) with Marc, VP Finance & Operations. This is a detailed look at the CyberOps department today: pods, team leads, clients, the main challenges for the next 12 months, and how you would approach them.

3. Business case (60 min) with Marc and Grégoire (VP Revenue). You get a realistic case about our operations one week in advance. You present your approach for 30 to 40 minutes, then we discuss it together. There is no single right answer. We care about how you think.

4. Last meeting with Erwan, our CEO. We talk about vision, leadership and fit with our values.