Director of Cyber Operations

Always On. Always Secure. Globally Connected.

Director of Cyber Operations About the role

Are you passionate about building and leading world-class security operations capabilities at scale? The Director of Cyber Operations is accountable for the day-to-day effectiveness and ongoing maturity of Boldyn’s global cyber security operations function. This is a small team environment, so the role blends hands-on technical delivery with operational leadership: you’ll set the operating model, drive automation and standardization, and personally provide escalation support when needed.

You will ensure consistent monitoring, detection, and response across global markets. Working closely with internal IT, cloud, network, and engineering teams, you will also govern and manage third-party Managed Security Service Providers (MSSPs) to deliver measurable security outcomes.

What you’ll be doing

As part of the global cyber security team, you’ll play a critical role in protecting Boldyn’s national telecommunications infrastructure. Colleagues across IT, cloud, network, and market engineering teams will rely on your technical expertise, leadership, and ability to continuously improve security operations processes and outcomes. It’s a role with significant variety and global impact, and day‑to‑day you’ll be involved in the following areas:

Own the global Cyber Operations operating model and ensure effective 24x7 monitoring and response (delivered via internal teams and MSSPs) across markets/environments.

Act as named operational owner for monitoring, logging, detection, and incident management controls; ensure design, operation, testing/validation, continuous control-health monitoring, remediation tracking, and audit evidence (e.g., ISO 27001 / Cyber Essentials+).Set telemetry standards and govern SOC architecture (SIEM/XDR, logging pipelines, case management), ensuring consistent onboarding and coverage across environments.

Own detection engineering and SOAR automation outcomes: use-case lifecycle (design/validate/tune/retire) plus automation at scale (e.g., Sentinel playbooks, case management, enrichment/integrations) to reduce alert fatigue and improve MTTD/MTTR.Provide hands-on technical escalation support (including threat hunting where needed) and contribute to priority detections/playbooks in a small-team environment.

Own incident response end-to-end: define severity/escalation and communications, lead major incidents, and drive PIRs/root-cause analysis and problem management through corrective actions and readiness improvements.

Govern MSSP performance and stakeholder engagement: run monthly service reviews with the business, track KPIs/SLAs, translate risk and performance into clear actions, and drive continual improvement.

What you’ll bring

Think you could make a difference here? We’re looking for someone who genuinely cares about the welfare of our team. You’ll want to make an impact from day one. With big ideas about how to improve our culture and the knowledge to get people on board. You will also have some of the following:

Deep expertise in Azure security, cloud and network architectures, including security maturity assessments, gap analysis, and governance alignment

Strong security operations leadership experience, including managing 24x7 monitoring/response services, major incident response leadership, and delivering outcomes across the Microsoft Security stack and Azure Sentinel Hands-on experience with detection engineering, threat hunting, log analytics, and Kusto Query Language (KQL)
Proven experience managing third-party security service providers (MSSP/MDR): contract/SOW management, KPI/SLA definition, monthly service review cadence, and clear risk/performance communication to agree priorities and drive corrective actions

Proven ability to design and implement SOAR use cases, including automation, malware sandboxing, and service desk integrations within Azure Sentinel

Experience with log source onboarding, data normalization, schema design, data quality assurance, and operational reporting (metrics/dashboarding), including use of the Microsoft Power Platform Solid understanding of threat actor TTPs,…