Manager, Threat Operations

About Us

Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them to defeat cyberattacks. Its solutions combine machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response.

Sophos offers industry-leading managed detection and response (MDR) alongside a comprehensive portfolio of cybersecurity technologies — including endpoint, network, email, and cloud security, extended detection and response (XDR), identity threat detection and response (ITDR), and next-gen SIEM. Together with expert advisory services, these capabilities help organizations proactively reduce risk and respond faster, with the visibility and scalability needed to stay ahead of evolving threats.

Sophos goes to market with a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and distributors, marketplace integrations, and cyber risk partners, giving organizations the flexibility to choose trusted relationships when securing their business. Sophos is headquartered in Oxford, U.K. More information is available at .

Role Summary

Sophos is seeking an experienced and motivated MDR Operations Manager is will be responsible for leading high-performing MDR teams and delivering consistent, high-quality security operations as part of our global 24x7 service. Based in Australia, this role will lead operational delivery during APJ hours, with a strong focus on people development, operational health, investigation quality, customer outcomes, and effective cross-region collaboration.

The role will use operational data, technology, automation, and continuous improvement to identify and remove friction, improve how our teams work, and help MDR operate more effectively at scale. Working closely with MDR leadership and partner teams, the MDR Operations Manager will ensure the operation is prepared for today’s demands while continuously improving how we respond to an evolving threat landscape.

What You Will Do

Lead and develop MDR Team Leads and analysts, setting clear expectations, providing regular coaching and feedback, supporting career development, and building an inclusive, accountable, high-performing team culture.

· Build leadership capability and succession within the operation by identifying, mentoring, and developing future technical and people leaders.

· Lead MDR operational delivery during APJ hours, ensuring appropriate staffing and coverage, effective workload balancing, queue health, prioritization, and achievement of service-level and customer commitments.

· Maintain a clear view of operational health, including demand, capacity, backlog, response times, investigation effort, quality, escalations, and emerging operational risks, taking action before issues materially impact customers or teams.

· Operate as part of a global 24x7 MDR service, working closely with leaders and teams across regions to maintain consistent operational standards and continuity of service.

· Ensure effective follow-the-sun operations through clear ownership, high-quality handovers, and timely escalation of operational risks and customer issues between APJ and other regions.

· Drive consistent and effective triage and investigation practices, ensuring analysts make sound decisions, focus effort where it creates the greatest customer value, and escalate cases appropriately based on risk, complexity, and customer impact.

· Establish and maintain high standards for investigation quality, case handling, documentation, customer communication, and operational processes. Use quality reviews, case reviews, coaching, and operational data to identify and address gaps.

· Use operational data and metrics to understand trends, identify performance and capacity issues, make informed staffing and prioritization decisions, and drive measurable improvements in operational efficiency, investigation quality, and customer outcomes.

· Act as a senior operational escalation point for customer-impacting situations, complex investigations, service risks, workload challenges, and cross-team dependencies, ensuring clear ownership, timely communication, and effective resolution.

· Support major security incidents and high-severity customer situations by coordinating appropriate MDR resources, ensuring effective escalation and handoffs, and maintaining clear communication with internal and customer stakeholders.

· Ensure operational resilience by maintaining appropriate contingency plans for unexpected demand, staffing constraints, tooling disruption, major incidents, and other events that could affect MDR service delivery.

· Build and maintain operational readiness through skills coverage, onboarding, training, knowledge management, playbooks, processes, tooling readiness, and appropriate leadership coverage.

· Lead operational readiness and change adoption for new detections, capabilities, tooling, automation, workflows, and process changes, ensuring teams understand what is changing, are prepared to operate effectively, and that intended improvements are realized after implementation.

· Identify and reduce operational friction, including noisy or low-value work, repetitive analyst activity, inefficient workflows, unnecessary escalations, and process gaps. Translate these opportunities into improvements through standardization, automation, tooling, or process redesign.

· Partner closely with Threat Intelligence, Detection Engineering, Incident Response, Product, Engineering, and other teams to improve detection quality, investigation effectiveness, and MDR's overall detection and response capability.

· Drive continuous improvement by turning operational data, analyst feedback, customer escalations, quality findings, and lessons learned into measurable improvements to MDR workflows and service delivery.

· Maintain a strong operating rhythm across the teams, ensuring operational priorities, risks, performance, improvement initiatives, and dependencies are visible, understood, and acted upon.

· Bring APJ operational perspectives, risks, and requirements into global MDR planning while driving consistent processes, standards, and customer outcomes across regions.

· Work closely with MDR leadership on capacity planning, operational strategy, organizational priorities, and transformation initiatives that improve scalability, efficiency, quality, and customer outcomes.

What You Will Bring

Essential:

· 7+ years of experience in cybersecurity operations, Managed Detection and Response, Security Operations Center operations, incident response, or a related discipline, including at least 2 years leading people, teams, or operational functions.

· Demonstrated experience leading security operations in a high-volume, customer-facing environment, with responsibility for staffing, workload management, queue health, prioritization, service levels, quality, and operational outcomes.

· Proven people-leadership experience, including coaching, performance management, career development, hiring, onboarding, and developing effective teams through clear expectations, constructive feedback, and accountability.

· Experience developing Team Leads, senior analysts, or other frontline leaders and building stronger leadership capability within security operations teams.

· Experience operating within a global or 24x7 security operations environment, including effective coordination, escalation, and handover across geographically distributed teams.

· Strong understanding of security operations and the end-to-end lifecycle of triage, investigation, escalation, response, and customer communication.

· Strong technical understanding of endpoint, network, cloud, identity, and security telemetry, with the ability to assess investigation quality, challenge technical conclusions, guide analysts, and make sound risk-based decisions.

· Experience managing operational and customer escalations, with the ability to quickly understand complex situations, establish clear ownership and priorities, coordinate across teams, and communicate effectively with technical and executive stakeholders.

· Experience using operational metrics and data to identify workload, capacity, performance, and quality issues, make informed operational decisions, and deliver measurable improvements.

· Demonstrated ability to improve operational efficiency through process simplification, standardization, automation, or better use of technology while maintaining investigation quality and customer outcomes.

· Strong understanding of attacker tools, tactics, and techniques, including persistence, lateral movement, credential theft, ransomware, and defense evasion, together with working knowledge of the MITRE ATT&CK framework.

· Experience working effectively across functions such as Detection Engineering, Threat Intelligence, Incident Response, Product, Engineering, and customer-facing teams to resolve operational issues and improve security services.

· Strong judgment and decision-making skills, with the ability to effectively balance customer impact, security risk, operational capacity, investigation quality, and business priorities.

· Excellent written and verbal communication skills, with the ability to communicate complex operational and security issues clearly to analysts, technical stakeholders, customers, and senior leaders.

· Relevant professional experience in cybersecurity, security operations, or a related discipline. Formal qualifications and certifications are valued but not required where equivalent experience can be demonstrated.

Desired:

· Experience leading MDR or security operations teams across Australia and/or the broader APJ region.

· Experience working within global, distributed security operations and collaborating across regions and time zones.

· Experience improving security operations through automation, AI-assisted capabilities, process redesign, or operational transformation.

· Experience partnering with Detection Engineering and other security teams to improve detection quality, reduce unnecessary analyst workload, and strengthen operational effectiveness.

· Relevant cybersecurity or leadership certifications such as CISSP, GCIH, CISM, or equivalent are beneficial but not required.

#LI-Remote
#B2

Ready to Join Us?

At Sophos, we believe in the power of diverse perspectives to fuel innovation. Research shows that candidates sometimes hesitate to apply if they don't check every box in a job description. We challenge that notion. Your unique experiences and skills might be exactly what we need to enhance our team. Don't let a checklist hold you back – we encourage you to apply.

What's Great About Sophos?

· Sophos operates a remote-first working model, making remote work the primary option for most employees. However, some roles may necessitate a hybrid approach. While we are a remote first organization, applicants must have legal authorization to work in the jurisdiction where the position is posted, without requiring employer sponsorship.

· Our people – we innovate and create, all of which are accompanied by a great sense of fun and team spirit

· Employee-led diversity and inclusion networks that build community and provide education and advocacy

· Annual charity and fundraising initiatives and volunteer days for employees to support local communities

· Global employee sustainability initiatives to reduce our environmental footprint

· Global fitness and trivia competitions to keep our bodies and minds sharp

· Global wellbeing days for employees to relax and recharge

· Monthly wellbeing webinars and training to support employee health and wellbeing

Our Commitment To You

We’re proud of the diverse and inclusive environment we have at Sophos, and we’re committed to ensuring equality of opportunity. We believe that diversity, combined with excellence, builds a better Sophos, so we encourage applicants who can contribute to the diversity of our team. All applicants will be treated in a fair and equal manner and in accordance with the law regardless of gender, sex, gender reassignment, marital status, race, religion or belief, color, age, military veteran status, disability, pregnancy, maternity or sexual orientation. We want to give you every opportunity to show us your best self, so if there are any adjustments we could make to the recruitment and selection process to support you, please let us know.

Data Protection

If you choose to explore an opportunity, and subsequently share your CV or other personal details with Sophos, these details will be held by Sophos for 12 months in accordance with our Privacy Policy and used by our recruitment team to contact you regarding this or other relevant opportunities at Sophos. If you would like Sophos to delete or update your details at any time, please follow the steps set out in the Privacy Policy describing your individual rights. For more information on Sophos’ data protection practices, please consult our Privacy Policy Cybersecurity as a Service Delivered | Sophos