Director, Cyber Security Operations

ABOUT THE JOB The ACLU seeks applicants for the full-time position of Director, Cyber Security Operations in the Administration Finance Department of the ACLU’s National office in New York, NY, or Washington, DC. This is a hybrid role that has in-office requirements of two (2) days per week or eight (8) days per month. The ACLU’s Information Security Department works to protect the confidentiality, integrity, and availability of the ACLU’s digital systems, data, and communications. We collaborate across departments and affiliates to defend against cybersecurity threats, implement cutting-edge security technologies, and foster a culture of security awareness. Our mission is to ensure that the ACLU can continue its critical work safeguarding rights and liberties, without compromise, in an increasingly complex and hostile digital landscape. WHAT YOU'LL DO Reporting to the Chief Information Security Officer , the Director, Cyber Security Operations will be responsible to lead and evolve the ACLU's operational security capabilities. This role is responsible not just for running day-to-day security operations, but for building a mature, intelligence-driven detection and response program grounded in adversary tradecraft and real-world attack paths. You will lead a small, high-impact team and own SOC operations, detection engineering, threat hunting, digital forensics, and incident response. This role is expected to operate at both a strategic and hands-on level — shaping detection strategy, guiding investigations, and ensuring the organization can rapidly detect, respond to, and recover from sophisticated threats. YOUR DAY TO DAY Responsibilities Lead and mature SOC operations with a focus on high-fidelity detection, signal-to-noise optimization, and measurable detection coverage. Own and evolve the detection engineering program, including development of detections mapped to adversary behaviors (e.g., MITRE ATTCK), continuous tuning, and validation through adversarial testing. Establish and lead a proactive threat hunting program focused on identifying unknown threats, attacker dwell time, and control gaps across identity, endpoint, cloud, and SaaS environments. Direct incident response and digital forensics efforts, including hands-on leadership during high-severity incidents, root cause analysis, and post-incident improvement. Integrate cyber threat intelligence into detection and response workflows, ensuring intelligence is operationalized into actionable detections and hunt hypotheses. Develop, test, and continuously improve incident response playbooks, escalation paths, and decision frameworks. Lead tabletop exercises and adversary simulation activities to validate detection and response capabilities against realistic threat scenarios. Drive operational resilience initiatives, including business impact analysis, recovery planning, and coordination with crisis management stakeholders. Partner closely with identity, cloud, and application teams to close detection and response gaps, with a strong focus on identity as the primary attack surface. Coordinate with physical security and external incident response partners during complex incidents. Build, mentor, and scale a high-performing security operations team, fostering a culture of curiosity, rigor, and adversarial thinking. Report on detection coverage, incident trends, adversary activity, and response effectiveness to senior leadership. FUTURE ACLU'ERS WILL Be committed to advancing the mission of the ACLU Center and embed the principles of equity, inclusion and belonging in their work by demonstrating commitment to diversity with an approach that respects and values multiple perspectives Be committed to work collaboratively and respectfully toward resolving obstacles and conflicts WHAT YOU'LL BRING Qualifications 10+ years of experience in cyber security operations, detection engineering, threat hunting, or incident response. Deep exper ... (truncated, view full listing at source)