Overview
At MoFo, we couldn’t write our own success story without yours. Ready to write your story?
Join MoFo as ASSOCIATE DIRECTOR, SECURITY OPERATIONSon our Information Technology team!
This role can be based in San Francisco, Palo Alto, Los Angeles, San Diego, Boston, New York or Washington, D.C.
https://www.mofo.com/offices
ABOUT THE ROLE
The Associate Director of Security Operations serves as the Firm’s operational and technical authority across security operations, incident response, threat detection engineering, threat intelligence, and digital forensics. Operating in a high-stakes legal environment, this leader ensures early threat detection and conducts rigorous, legally defensible investigations into security, privacy, and internal workplace matters.
Acting as a true player-coach, the Associate Director bridges strategic leadership and hands-on execution. The role oversees the Firm’s 24/7 Managed Detection and Response (MDR/MSSP) partner, manages direct operational talent, and serves as Incident Commander during critical security events. The Associate Director partners closely with the Chief Information Security Officer (CISO), Chief Information & Innovation Officer (CIIO), the Office of the General Counsel (OGC), and Enterprise Infrastructure/Cloud teams.
A primary objective is driving operational leverage: maturing detection coverage, orchestrating response playbooks, and deploying SOAR automations to maximize efficiency before scaling headcount. As the threat landscape and firm requirements evolve, the Director collaborates with the CISO to develop data-driven business cases for targeted team expansion and specialized staff augmentation.
Incident Response & Cyber Resilience
- Lead the Firm's incident response program, including preparation, testing, response, recovery, and lessons learned.
- Serve as incident commander for critical incidents: run the bridge, set priorities, assign work, and keep leadership informed.
- Investigate, contain, and resolve incidents hands-on, including triage and root cause analysis, and work with IT to fix underlying weaknesses.
- Engage and direct third-party retainers, such as forensics firms and outside counsel, and run investigations under attorney-client privilege at the direction of counsel.
- Develop, test, and refine response playbooks, including out-of-band communication plans for when primary systems are compromised.
- Design and run tabletop exercises for technical teams and Firm leadership, and track corrective actions to completion.
- Maintain 24x7x365 escalation paths with the MSP and take part in the off-hours on-call rotation.
Security Operations & MSP Oversight
- Own the Firm's security monitoring and response capabilities, including Microsoft Sentinel, Microsoft Defender, Mimecast, and related security operations technologies.
- Lead monitoring and analysis of security events across networks, endpoints, email, and cloud infrastructure, and personally investigate high-severity alerts.
- Own the relationship with the 24x7 MSP: set service levels, review performance against them, and hold the provider accountable.
- Automate triage and response through SOAR so the function handles more volume without adding staff.
- Help develop and enforce security policies, standards, and operating procedures that meet the Firm's regulatory and client obligations.
Detection Engineering, Threat Hunting & Intelligence
- Build, tune, and retire detections mapped to MITRE ATT&CK, and track coverage against it.
- Run proactive threat hunts to find and stop emerging threats before they cause harm, with attention to SaaS, cloud, and AI-related attack vectors.
- Run the cyber threat intelligence (CTI) program, using sources such as Recorded Future to set detection and hunting priorities and to brief leadership on threats relevant to the Firm.
- Use threat intelligence and vulnerability management data to prioritize remediation with Infrastructure and Cloud teams, and build custom detections and mitigations for vulnerabilities that cannot be fixed quickly.
- Lead threat modeling for critical systems, cloud services, and AI-enabled solutions.
- Run purple team exercises to validate controls and expose gaps in policy and procedure.
Insider Risk & Data Protection Monitoring
- Build and operate insider threat detection in partnership with Legal, HR, Privacy, and data protection teams.
- Use Microsoft Purview, BigID, and related platforms to detect and respond to data loss and misuse of client, Firm, and regulated information.
Investigations & Digital Forensics
- Define, document, and run the Firm's investigations program for security, privacy, and workplace incidents.
- Set practices for severity assessment, evidence capture and preservation, chain of custody, support for law enforcement requests, and escalation to leadership.
- Build digital forensics and incident response (DFIR) capability using a mix of internal staff and external providers.
- Maintain investigation workflows and incident playbooks in the Firm's systems of record.
- Work with the CISO, General Counsel, senior lawyers, and business stakeholders to scope investigations, commission outside help, and coordinate status updates and internal communications.
Metrics, Team Leadership & Growth
- Operate as a player-coach: lead and develop one direct report while staying hands-on in detections, investigations, and incidents.
- Define and report operational metrics, such as mean time to detect, mean time to respond, ATT&CK coverage, and MSP service level performance, to show progress and guide investment.
- Manage security operations vendor relationships and provide input on budget and tooling decisions.
- Partner with the CISO to grow the team over time, backed by data-driven business cases for new staff or staff augmentation.
- Foster a culture of accountability, continuous improvement, and service to the Firm's lawyers and clients.
ABOUT YOU
Education and Professional Credentials
- Bachelor's degree in Information Security, Computer Science, Information Systems, Cybersecurity, or a related field required.
- CISSP or equivalent certification is strongly preferred. GIAC certifications such as GCIH, GCIA, GCFA, or GCTI a plus.
- Advanced degree preferred but not required.
Experience Requirements
- 10+ years building infrastructure and security programs, implementing and managing security solutions, and leading incident response.
- 3+ years leading or working in an enterprise Security Operations function.
- Experience as incident commander during critical incidents, including running the bridge, directing third-party retainers, and operating under privilege.
- Hands-on experience with digital forensics, evidence preservation, and chain of custody, and with investigations involving legal counsel, HR, or law enforcement.
- Experience managing a 24x7 MSP or MSSP relationship against defined service levels.
- Experience building SOAR automation and developing and refining response playbooks.
- Experience running purple team and tabletop exercises, including out-of-band communication scenarios.
- Experience in a law firm or professional services environment a plus.
Technical and Industry Knowledge
- Deep knowledge of incident response, cyber threat intelligence, threat hunting, insider threat, detection engineering, and threat modeling.
- Deep expertise in MITRE ATT&CK, Attack Kill Chain analysis and relevant frameworks.
- Hands-on expertise with Microsoft Defender EDR/XDR, Microsoft Sentinel SIEM, Microsoft Purview, Mimecast, and Recorded Future, or similar platforms, along with vulnerability management tools.
- Strong technical depth in network, systems, cloud, and application security, and current knowledge of SaaS and AI attack vectors.
Leadership and Communication Competencies
- Player-coach who balances strategic planning with hands-on execution.
- Calm, decisive leadership under pressure during critical incidents.
- Uses metrics and operational data to make the case for priorities, tools, and headcount.
- Influences without authority and builds trusted relationships across a matrixed organization.
- Explains complex security issues clearly to lawyers, business leaders, and executives, in writing and in person.
- Low-ego, collaborative, and committed to developing talent.
ABOUT MOFO
At MoFo, we collaborate as one firm, across borders, practice areas, and business functions and value fresh ideas and innovation over conformity and competition.
ABOUT OUR BENEFITS
MoFo offers a comprehensive benefits package starting on your first day.
- A variety of options for medical, dental, vision, life and disability coverage to meet the needs of you and your family.
- Industry-leading parental leave and family benefits including adoption and fertility treatment options and backup child and elder care.
- Global wellness program, including free access to Talkspace and Calm apps.
- Annual community service day to make an impact on your community and a birthday holiday just for fun.
- Education reimbursement annually.
- Dedicated Talent Development team.
- Competitive annual profit-sharing contribution.
Where required by law, salary ranges are stated below. Additional compensation may include a discretionary bonus, overtime as applicable, health/welfare benefits, retirement contributions, paid holidays, and PTO. The range displayed is specifically for positions performed in those cities/states and may vary based on factors including but not limited to the following: local market data and ranges; an applicant's skills and prior relevant experience; and certain degrees, licensing, and certifications. We will consider qualified applicants with criminal histories in a manner consistent with all applicable federal, state, and local laws, including Fair Chance Laws and Ordinances.
New York, San Francisco, Palo Alto salary range: $184k to $257k
Los Angeles, San Diego, Boston, Washington, D.C. salary range: $175k to $244k
For questions regarding this position, please e-mail jobs@mofo.com
