Cyber Defense Unit Manager

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution.

We are looking for an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. You will build a high-performing team and continuously improve our ability to anticipate, detect, and respond to evolving cyber threats.

The ideal candidate combines deep cybersecurity expertise, operational leadership, and people management to build a modern, intelligence-driven cyber defense function. You are comfortable operating in a fast-paced global technology environment and can move seamlessly between strategy, hands‑on operations, major incidents, and executive-level communication.

• Lead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement (e.g., against NIST CSF or SOC‑CMM)
• Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, ensuring coverage across time zones, including follow‑the‑sun or on‑call models
• Define the build‑versus‑buy approach for the function, including management of MDR/MSSP and other external partners, and manage the Cyber Defense budget

• Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments
• Establish and maintain SOC processes, runbooks, severity definitions, and handoffs to ensure consistent, high‑quality investigations
• Lead proactive, hypothesis‑driven threat hunting and attack surface monitoring, including identity‑based and cloud‑native threats

• Own the detection engineering lifecycle: use case development, testing, tuning, deployment, and retirement, with a focus on reducing false positives and alert fatigue
• Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk
• Ensure telemetry completeness by defining log source requirements and onboarding priorities with IT, Cloud, and Engineering
• Run purple team and adversary emulation exercises to validate detection and response effectiveness

• Lead response to significant cybersecurity incidents, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadership
• Maintain and test incident response plans, playbooks, and crisis communication procedures, including regular tabletop exercises with senior stakeholders
• Oversee digital forensics, evidence handling, containment, eradication, and recovery, working with Legal to preserve privilege and support investigations, legal holds, and regulatory inquiries
• Support breach assessment and regulatory notification decisions with Legal and Compliance (e.g., GDPR, HIPAA, SEC disclosure, and other applicable obligations)
• Run post‑incident reviews and drive corrective actions to closure.

• Build and manage a threat intelligence capability that tracks threat actors, campaigns, and techniques relevant to Acronis, its customers, and the MSP ecosystem
• Translate intelligence into actionable detections, hunts, blocking actions, and risk‑informed recommendations for leadership
• Participate in industry intelligence‑sharing communities and partnerships…