Director of Security Operations

Director of Security Operations ABOUT FLUIDSTACK At Fluidstack, we’re building the infrastructure for abundant intelligence. We partner with top AI labs, governments, and enterprises - including Mistral, Poolside, Black Forest Labs, Meta, and more - to unlock compute at the speed of light. We’re working with urgency to make AGI a reality. As such, our team is highly motivated and committed to delivering world-class infrastructure. We treat our customers’ outcomes as our own, taking pride in the systems we build and the trust we earn. If you’re motivated by purpose, obsessed with excellence, and ready to work very hard to accelerate the future of intelligence, join us in building what's next. ABOUT THE ROLE Fluidstack operates the compute infrastructure that powers frontier AI, including some of the most demanding training and inference workloads on the planet. We are building a Security Operations function from the ground up, and we want to build it right: AI-native, highly automated, and designed for the scale and threat model of a company that sits at the intersection of critical infrastructure and frontier AI development. The threat model here is not a narrow one. We operate corporate infrastructure and data center sites across multiple geographies, complex IT and OT/ICS environments, and cloud infrastructure, all serving customers whose work attracts sophisticated, persistent, and well-resourced adversaries. State-nexus actors, insider risk, supply chain compromise, physical intrusion, and infrastructure disruption are all real considerations. The SOC you build has to be credible against all of them, and the operating model has to hold up in a multi-stakeholder environment that includes upstream and downstream customers and partners with their own security requirements, audit rights, and contractual SLAs. This is not a role for someone who wants to manage a room full of analysts watching dashboards. This is a role for someone who wants to architect an entirely different model, one where AI handles L1 at scale, agentic workflows close the loop on routine response, a real threat intelligence function that drives detection, and where human analysts spend their time on work that requires genuine expertise and judgment. You'll be a builder across three dimensions simultaneously: the technical architecture, the operating model, and the team. If you've been frustrated watching the industry default to "hire more people" when the answer is "build better systems," this is the role you've been waiting for. FOCUS - SOC Architecture & Build: design and build FluidStack's security operations capability from scratch, including data architecture, detection logic, automation fabric, toolchain, and team model, using a modern stack - AI-Native Detection & Triage: define and implement a detection philosophy that assumes AI handles L1; build the pipelines, enrichment logic, and triage automation that resolves high-volume, low-ambiguity alert classes without human intervention - Agentic Response Workflows: design and deploy autonomous response workflows that contain, investigate, and remediate: not just notify; own and continuously push the boundary between machine-closed and human-required cases - LLM-Assisted Investigation: integrate LLM-based tooling into the analyst workflow for case summarization, log interpretation, and hypothesis generation; define how AI augments analyst cognition as a genuine force multiplier - Detection Engineering: own the detection content lifecycle end-to-end: MITRE ATT&CK coverage mapping, detection-as-code workflows, alert quality metrics, and continuous tuning across a heterogeneous environment - Threat Intelligence: build and operationalize a threat intelligence program that produces finished intelligence relevant to FluidStack's specific threat model and customer base, and connects directly to detection content and hunting hypotheses - Threat Hunting: design and run a proactive hunting capabilit ... (truncated, view full listing at source)