Head of Security Operations

Remote from: 🌐 Anywhere
Annual salary: Undisclosed
Salary information is not provided for this position. Check our Salary Directory to estimate the average compensation for similar roles.
Department: Cybersecurity
Employment type: Full Time,
Job posted: 21 Jul 2026
Apply before: 21 Aug 2026
Experience level: Director
Views / Applies: 62 / 3

About company

About Canonical Ltd.

Trusted open source for enterprises

Computer Software
2004

Actively Hiring

AI Summary

This is a global leadership role at Canonical to manage the Security Operations (SecOps) team. The role involves designing and implementing security practices, tools, and policies to protect Canonical's data, infrastructure, and build processes. The manager will lead a high-performing team, collaborate with other departments, and contribute to the wider open-source security ecosystem. The ideal candidate has deep hands-on expertise in security tooling, SOC architecture, and incident response. This position reports to the CISO and requires a strategic mindset combined with technical proficiency.

Role DNA

Job Complexity

Easy Hard

Pace & Pressure

Relaxed Fast-paced

Autonomy Level

Guided Full Ownership

Communication Load

Independent Highly Collaborative

AI Insight This role demands expert-level technical knowledge, strategic leadership, and the ability to handle sophisticated threats, making it one of the most challenging positions in cybersecurity.

Salary Analysis

AI Insight The offered salary is not specified, but for a senior leadership role like Head of Security Operations, the market range in the US is typically $150,000 to $350,000. The estimated median of $225,000 is competitive for a global company like Canonical, especially considering the high level of responsibility and expertise required.

Core Skills Required

Security Operations SOC Architecture Linux Security Threat Intelligence Incident Response Team Leadership Cyber Security Strategy NIST CSF Open Source Security

Cover Letter Sample

Dear Hiring Team,

I am writing to express my enthusiasm for the Head of Security Operations position at Canonical. With over 15 years of experience in cybersecurity, including leading SOC teams and developing enterprise-wide security strategies, I am confident in my ability to drive Canonical's security posture to the next level. My expertise in Linux security, threat intelligence, and incident response aligns perfectly with the requirements outlined in the job description. I am particularly drawn to Canonical's commitment to open source and its impact on the broader ecosystem. I look forward to the opportunity to contribute to your team and help safeguard Canonical's infrastructure and products.

Sincerely,
Jane Doe

Sample Interview Questions

Can you describe your experience with designing and implementing a Security Operations Center (SOC) from the ground up?

In my previous role at a global tech firm, I led the design and deployment of a SOC that handled over 10,000 alerts daily. We implemented a tiered system with SIEM, SOAR, and threat intelligence integration. I focused on creating efficient workflows for detection, triage, and response, which reduced mean time to detect (MTTD) by 40%.

How do you stay current with advanced threat actors and nation-state threats?

I actively participate in threat intelligence sharing groups like FS-ISAC and attend industry conferences. I also follow security researchers and contribute to open-source threat intel platforms. My team regularly conducts tabletop exercises based on real-world attack scenarios to ensure preparedness.

How would you approach hiring and mentoring a team of security professionals?

I look for candidates with a blend of technical skills and curiosity. For mentoring, I establish clear career paths, provide hands-on training, and encourage participation in external training and certifications. I also foster a culture of knowledge sharing through weekly tech talks and post-incident reviews.

Can you give an example of a complex incident you managed and how you coordinated the response?

We detected a sophisticated APT campaign targeting our network. I activated the incident response plan, assembled a cross-functional team, and used our SOAR platform to automate containment. We worked with external intelligence partners to identify the threat actor's infrastructure. The response minimized data exfiltration and led to improved detection rules.

How do you integrate security into an agile development process?

I advocate for 'security as code' by embedding security checks into CI/CD pipelines. We use automated scanning for vulnerabilities and misconfigurations. I also ensure security representatives are part of sprint planning and review sessions to provide timely feedback. Regular security training for developers is key to shifting left.

This global leadership role in cyber security is to manage the Security Operations (SecOps) team responsible for design, implementation and evolution of Canonical security practices, techniques, tools, systems and policies. The team is the primary owner of strategy and practices that determine how Canonical secures its data, internal infrastructure and build processes. They are responsible for assuring the security and integrity of our own infrastructure and product deployments. They design and implement technical security controls that ensure security threats are automatically identified, contained and remediated. The team will also contribute ideas and requirements for Canonical product security, improving the resilience and robustness of all Ubuntu customers and users subject to cyber attack.

As a leader on cyber security in the company, the SecOps team manager will collaborate with our Organisational Learning and Development team to develop playbooks and facilitate SecOps training across Canonical. They will operate in a wider security organisation, run a high performing security team and improve Canonical’s security posture. They will lead initiatives to integrate the team’s insights into Canonical’s broader software development process.

While this is a management position, we expect managers to be expert practitioners, able to lead by example, contribute at the highest level, and assess work based on their own professional experience and skill. Candidates should have deep, hands-on expertise with a range of open source and proprietary security tooling and practices, which they can integrate into a holistic next generation security solution across the breadth of Canonical’s interests.

The SecOps team’s mission is not only to secure Canonical, but also to contribute to the security of the wider open source ecosystem. They might share knowledge through public presentations and industry events, and share threat intelligence with the wider community or represent Canonical in sector-specific governance bodies.

This role reports to the CISO.

What you will do in this role:

Hire and mentor a team of outstanding technical security professionals
Define Canonical’s SecOps security standards and playbooks
Own and drive the architecture and design of the SOC
Analyse and improve Canonical’s security architecture
Evaluate, select and implement new security tools and practices
Identify, contain and guide the remediation of security threats and cyber attacks
Grow the presence and thought leadership of Canonical SecOps practice
Contribute to open source threat intelligence initiatives
Drive threat modelling, table top exercises and other SecOps practices across Engineering, IS and Canonical
Develop Canonical SecOps learning and development materials
Publish blog posts, whitepapers and conference presentations
Identify, implement and track SecOps KPIs
Plan and deliver SecOps work in the framework of Canonical’s agile engineering practice
Work with Security leadership to present information and influence change

What we are looking for

Proven track record of mitigating with advanced threat actors and nation state threats
Expert technical understanding of SOCs from the ground up
In depth knowledge of SOC architecture and design including strategies for logging, firewalls, network segmentation, honeypots etc
Someone who understands how the SOC works not just how to use it
Expert in Linux security
Ability to define, implement, automate and measure effective incident response playbooks
Knowledge of security architecture and market-leading security tools
Experience contributing to, and consuming, threat intelligence feeds
Experience in security risk management frameworks such as NIST CSF
An exceptional academic track record from both high school and university
Undergraduate degree in Computer Science or STEM, or a compelling narrative about your alternative path
Drive and a track record of going above-and-beyond expectations
Deep personal motivation to be at the forefront of technology security
Leadership and management ability
Excellent business English writing and presentation skills
Confidence to report security performance metrics with accountability for accuracy and completeness