Director, Security Operations (Security Engineering)

Clear goals. Strong teams. Real results. As Director, Security Operations, you’ll set the direction for how Delivery Hero detects, investigates and responds to threats across every entity and platform. You’ll move our CSIRT and SOC teams from baseline monitoring to an intelligence-driven, proactive defense, built on Google SecOps. You’ll report to the CISO and be the person who leads when a critical incident hits.

You’ll lead our existing CSIRT and SOC teams, based at our global headquarters in Berlin, and scale capabilities where needed. You’ll work closely with local CISOs and security leads to give millions of daily customers one consistent standard of protection.

Join the team that protects Delivery Hero’s ecosystem, customer trust, and global platforms. In the Security Team, you’ll tackle high-impact challenges across cyber defense, application security, cloud governance, and risk mitigation. Your work will directly safeguard millions of users and vendors worldwide, ensuring our technology scales securely and complies with global standards as we deliver amazing experiences every day.

• Lead the CSIRT and SOC managers and their teams: set clear expectations, give 360 feedback and build an engaging, diverse place to work.
• Set the strategy for security operations and run an OKR and roadmap process that aligns threat detection, incident response and threat intelligence.
• Modernize detection and response with Google SecOps (SIEM) and advanced telemetry, turning threat actor TTPs into high-fidelity detections that cut noise and reduce MTTD and MTTR.
• Coach teams to excellent incident handling and act as incident commander for critical incidents, owning stakeholder communication and post-incident follow-up.
• Partner with local CISOs and security leads across all entities to set consistent monitoring and incident response standards.
• Use data to diagnose issues and show measurable risk reduction against MITRE ATT&CK, with diligent budget governance.

• Proven leadership of Security Operations Centers (SOC) and Incident Response (CSIRT) functions in large, complex enterprise or tech environments, balancing day-to-day incident demands with long-term improvements.
• Deep experience managing complex, critical security incidents and building proactive threat hunting programs.
• Strong working knowledge of modern cloud-native SIEM and SecOps platforms, including telemetry ingestion, detection-as-code and automated response playbooks (SOAR).
• Clear communication and crisis management skills, turning complex technical incidents into actionable risk insights for executives, regional CISOs and legal partners.
• Proven success recruiting, retaining and growing senior engineers and managers, including managers of managers, and running global follow-the-sun or escalation models.