Manager, Security Operations

What you'll do at Figma:

• Own Figma's security monitoring and incident response program, from detection engineering through post-incident review and continuous improvement
• Build and automate security operations workflows, including alert triage, enrichment, investigation, and response actions using SOAR and custom tooling
• Develop and maintain incident response run books, escalation procedures, and communication plans for security events of varying severity
• Lead incident response preparedness initiatives, including tabletop exercises, red team engagements, and response capability assessments
• Improve the effectiveness of our SIEM and SOAR platforms by reducing noise, increasing signal fidelity, and closing detection coverage gaps
• Build and operationalize threat intelligence capabilities to identify adversary behaviors, prioritize investments, and strengthen detection and response programs
• Partner with Legal, Privacy, and Communications teams to support breach notification and regulatory response obligations during significant security incidents
• Drive security operations strategy through vendor management, operational metrics, and cross-functional initiatives spanning IAM, vulnerability management, DLP, and exposure reduction

We'd love to hear from you if you have:

• 7+ years of experience in security operations, incident response, or a related security engineering function
• Hands-on experience building and automating detection and response workflows using scripting, APIs, or security automation platforms
• Deep expertise with SIEM and SOAR technologies in a cloud-native or SaaS environment
• Demonstrated success building, scaling, or significantly improving a detection and response program
• Experience leading complex security incidents and partnering with Legal, Privacy, and business stakeholders during high-impact events

While it's not required, it's an added plus if you also have:

• Operated in a public company environment with SOX, ISO 27001, SOC 2,...