Director, Cybersecurity Operations

KLDiscovery is a leading global provider of best-in-class eDiscovery, information governance, and data recovery solutions, serving AmLaw 100 firms, Fortune 500 corporations, and government agencies. Our technology-enabled services and software help these law firms, corporations and agencies solve complex data challenges. Our Nebula and Rel One platforms deliver SaaS-based legal technology underpinned by managed services and professional services. The company, with offices in 26 locations across 17 countries helps clients with their litigation, regulatory compliance, internal investigation and data recovery and management needs all around the world.

Serving clients for over 30 years, KLDiscovery offers data collection and forensic investigation, early case assessment, electronic discovery and data processing, application software and data hosting for web-based document reviews, and managed document review services. In addition, through its global Ontrack Data Recovery business, KLDiscovery delivers world-class data recovery, email extraction and restoration, data destruction and tape management.

KLDiscovery has been recognized as one of the fastest growing companies in North America by both Inc. Magazine (Inc. 5000) and Deloitte (Deloitte's Technology Fast 500. Additionally, KLDiscovery is an Orange-level Relativity Best in Service Partner, a Relativity Premium Hosting Partner and Relativity's 1st Service Provider partner, and maintains ISO/IEC 27001 Certified data centers.

The Director, Cybersecurity Operations leads Security Operations and Incident Response, Security Engineering, Vulnerability Management, and Threat Intelligence. This is a player‑coach leadership role reporting directly to the CISO, partnering with the Director, Cyber GRC as one unified cyber team. The Director will bring hands‑on technical depth, strong leadership capability, and the ability to modernize security operations through MDR deployment, AI-informed detection, and a security engineering team organized around functional specialization.

This is a fully remote position

At KLD we invest in employees and their families by placing their wellbeing first. We offer competitive total compensation that includes base pay, bonus potential, inclusive benefits, wellness programs, and perks. We use market and industry data to inform pay decisions while considering geography and labor markets, individual experience, and business needs. Individual compensation will vary, although a reasonable estimate of the current annualized base pay range for this position is $175,000 to $215,000.

• Own the MDR relationship, including SLA management, escalation accountability, detection tuning, and quarterly threat hunt reviews
• Lead the incident response function: IR runbooks, major incident coordination, executive communication during active incidents, and post-incident root cause analysis
• Oversee SOC detection engineering, ensuring SIEM rules, SOAR playbooks, and automated response actions are maintained, tested, and tuned to the current threat landscape
• Direct and develop the security analyst pool, redeploying analyst capacity from frontline triage toward MDR validation, threat hunt support, and stakeholder reporting

• Oversee four specialized engineering lanes [endpoint, identity, cloud, and application security], ensuring each lane has clear ownership, defined scope, and measurable outcomes
• Drive security architecture reviews and engineering decisions for large or complex IT projects, ensuring security requirements are built in rather than bolted on
• Shape the security tooling stack strategy, evaluating, selecting, and retiring tools across endpoint, identity,…