Senior Manager, MXDR; Managed Extended Detection and Response

Senior Manager, MXDR (Managed Extended Detection and Response)

Todyl, Inc. Atlanta, Georgia, United States

At Todyl, we are on a mission to protect small and medium-sized businesses from ever-changing cyber threats. The Todyl platform fully integrates threat, risk, and compliance management to provide exceptional and affordable unified cybersecurity solutions to MSPs (Managed Service Providers) and their end customers.

At the end of the day, we're here to keep our partners and customers safe and help them manage the risks and comply with regulations. Protecting others requires a team that works together with trust and cares deeply about carrying out our mission.

• Team Leadership: Manage the full MXDR team — DRAMs and analysts — owning 1:1s, performance, career development, hiring and retention, with a cadence that fits shift work and a dispersed team rather than a 9-to-5 one.
• Coverage & Scheduling: Own shift coverage and scheduling approval across day, evening and overnight rotations and the front-of-week / back-of-week split, including PTO and the coverage math behind it.
• Developing the Leads: Develop the Partner Security Advisor (Lead) and the Detection & Response Operations (Lead), holding the line between lead duties and management responsibilities, and build the bench behind them through rotating floor authority.
• Service Delivery: Own SLA definition and attainment for MXDR, the quality of partner-visible output, and the alert-to-case lifecycle in practice — how alerts are worked, when they become cases, and where the handoffs leak.
• Production Ownership: Run incident review for significant events, set the acceptance bar for detection quality with Detection Engineering, and turn findings into changes that hold rather than action items that expire.
• AI in Security Operations: Decide where AI-assisted triage and tuning belong in our workflows and where a person stays in the loop, set the standards for the workflows our practitioners build themselves, and own how we check the output — including saying no to a capability that cannot clear the bar.
• Security Organization Direction: Partner with Detection Engineering, Threat Intelligence and Security Platform Engineering to set direction for the security organization — shared standards, where investment goes, and how the pieces fit together across our teams.
• Partner Escalation: Act as the escalation backstop when a DRAM cannot resolve a situation, hold the relationship with our largest partners, and feed cross-partner patterns into engineering priorities. Routine service reviews stay with the DRAMs.

• Extreme ownership, particularly when things go wrong or aren't completed on time.
• Intrinsic drive for growth; self-motivated, always learning, and focused on raising the bar for self and team.
• Strong bias for action with impact; make tough decisions quickly, measure results, and iterate with clarity to move the mission forward.

• Experience: 7+ years in security operations, incident response or detection and response, including hands-on time working alerts and running incidents.
• Management: 3+ years managing security or technical teams, with experience managing 10 or more people and developing senior individual contributors into leads or first-line managers.
• Distributed & 24/7 Leadership: Experience leading a dispersed team across sites and shifts — on-call, coverage planning, and the realities of managing people you are not in the room with.
• Education &
  
  Certifications:
  
  Advanced industry certifications (e.g., GCIH, GCIA, CISSP, CISM) preferred. Bachelor's degree or equivalent experience required.
• Domain Knowledge: Working knowledge of how SOCs operate — how analysts work alerts, hunt, and manage cases — with…