Senior Manager, Security Operations Center

The Information Security organization advances the overall state of security at Rubrik through critical initiatives and coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our assets, provides awareness education to teams on security best practices for data protection, and ensures data governance and data sharing relationships with third parties in order to securely protect Rubrik information.

Rubrik is hiring a Senior Manager to lead our Security Operations Center, including our FedRAMP-authorized environment. Incident response sits at the core of what the SOC does, alongside detection and monitoring, and this role owns all of it. You'll inherit a SOC that has already grown a lot in scale and maturity, and your job is to take it further: stronger detection and incident response, broader coverage as our environment gets more complex, and a real strategy for AI in the SOC.

Driving our AI SOC transformation is a core part of this role. You'll be the one setting the strategy for how AI enables the SOC: scaling coverage beyond what headcount alone could support, reducing alert fatigue on L1 analysts, and giving analysts more room to focus on complex investigations and incident response.

You'll also own SOC leadership for our FedRAMP environment: same detection, incident response, and operational rigor, applied to the teams and processes inside that compliance boundary.

Team Leadership & Development-

• Hire, train, mentor, and evaluate SOC analysts across both commercial and FedRAMP-scoped teams.

• Build a culture of collaboration, ownership, and continuous learning within the SOC.

• Keep an eye on signal quality and analyst experience so analysts are working real alerts, not chasing noise.

• Develop career paths, training programs, and succession planning for SOC analysts.

Monitoring & Incident Response-

• Direct 24/7 monitoring and make sure coverage stays consistent across shifts and regions.

• Serve as Incident Manager for major security incidents, leading the response and collaborating across InfoSec teams as needed during investigations.

• Drive continuous improvement of SOC processes, including incident response playbooks, runbooks, and escalation procedures.

• Make sure incident response processes hold up to the extra rigor FedRAMP requires.

AI SOC Strategy & Tooling-

• Own the roadmap for AI-enabled SOC capabilities: AI-assisted triage, investigation support, response automation.

• Deploy AI/ML and automation to cut down L1 toil and alert fatigue, so analysts spend more time on complex investigations.

• Work with Threat Operations and Security Engineering to evaluate, pilot, and roll out AI SOC tools.

• Enable the safe use of AI tools internally, while building the SOC's ability to detect and defend against AI-enabled threat actors.

Detection Tuning & Coverage Expansion-

• Partner with Threat Operations to grow detection maturity and expand coverage as the Rubrik environment grows (cloud, SaaS, on-prem, and FedRAMP systems).

• Work with Threat Operations to close detection gaps, cut false positives, and keep detections aligned to current threat intel and MITRE ATT&CK.

• Feed incident findings back to Threat Operations to drive continuous improvement of detection logic.

• Close the loop with Security Engineering to bring in additional logging based on incident and investigation data.

Strategy & Operations Management-

• Set the