Director of Security Operations & Detection Engineering, RFA

Remote (US) · Remote
Full-time
Posted Nov 15, 2026

Skills

Operations
Logistics

Job description

About RFA and Titan

RFA is a leading IT and cybersecurity partner to financial services firms: hedge funds, private equity, asset managers, and the firms that serve them. RFA is part of Titan, which is building the AI workforce for IT.

Titan has raised over $100M from General Catalyst, 8VC, and CalPERS, acquired market-leading IT firms like RFA, and put AI agents into production in large enterprises. We've automated 100K+ tickets across 800+ customers and are leading the industry in service quality. Our tech team has talent from Scale AI, CoreWeave, Vanta, Dropbox, Meta, FiveRings, TwoSigma, Amazon, Harvard, Stanford, and MIT.

Why this role, why now

Attackers targeting financial firms have moved to identity: MFA fatigue, session token theft, mailbox takeover. Catching that across 100+ client environments takes well-built detections, clean telemetry and fast automation. More analysts won't solve it.

We're looking for a builder who also leads. You'll design and run the stack behind RFA's SOC, put Titan's AI agents to work on triage and response, and lead the team that handles what the agents can't.

About the role

As Director of Security Operations & Detection Engineering, you own RFA's detection and response capability end to end. That covers the SIEM, EDR and identity telemetry, the detections and playbooks, how every new client gets onboarded, and the analysts who run it 24/7. You'll report to RFA's CISO. You'll also work closely with Titan's engineering team, who build the agents and automation from your requirements.

You'll measure success by time to detect and contain, detection coverage across client environments, false-positive and escalation rates, and incidents caught before they become client problems.

This role is remote (US).

In this role you will

•Own the architecture of RFA's security operations stack, including SIEM, EDR, identity and email security, and decide what we build, buy, consolidate or retire

•Build a repeatable onboarding playbook that brings each new client, and each acquired MSP, onto standard log sources, integrations and baseline detections

•Write and tune detections for the threats financial firms actually face: impossible travel, MFA fatigue, token replay, malicious mailbox rules, business email compromise

•Design triage and response automation with Titan's engineers, turning your playbooks into AI agent workflows with the right guardrails

•Lead, hire and develop RFA's SOC team. Set the bar, coach analysts, and hire people better than you

•Run serious incidents hands-on, from first alert through containment, evidence preservation and the client debrief

•Find and close coverage gaps across RFA's own environment and our clients'

•Report SOC performance clearly to the CISO and to client leadership in business reviews

You might thrive in this role if you

•Bring 8+ years in security operations, including time as a hands-on security engineer, detection engineer or incident responder, and 2+ years leading a SOC or security engineering team

•Have built or run security operations at an MSSP, MDR provider or MSP, across many client environments at once

•Have deployed and tuned a SIEM and EDR platform yourself, not just used one someone else set up

•Know Microsoft 365, Entra ID and Defender deeply, and know how identity attacks show up in the logs

•Write code and queries comfortably: Python, KQL/SPL or similar, plus APIs and SOAR tooling

•Are excited, not threatened, by AI agents doing triage, and have opinions on where humans must stay in the loop

•Can walk a fund COO through an incident in plain language, then go back and fix the detection that missed it

•Take extreme ownership and would rather build the system than inherit one

Bonus

•Experience with financial services clients and their regulatory needs (SEC, FINRA, Reg S-P, UK FCA)

•Detection-as-code, threat hunting or digital forensics experience

•GCIH, GCIA, GCFA, OSCP or similar

•Experience integrating acquired companies' security stacks

Logistics

Location: Remote (US)

Travel: Under 5%, for occasional client meetings and time with the team in NYC