About Accelerant
Accelerant is a data-driven risk exchange connecting underwriters of specialty insurance risk with risk capital providers. Accelerant was founded in 2018 by a group of longtime insurance industry executives and technology experts who shared a vision of rebuilding the way risk is exchanged – so that it works better, for everyone. The Accelerant risk exchange does business across more than 20 different countries and 250 specialty products, and we are proud that our insurers have been awarded an AM Best A- (Excellent) rating. For more information, please visit www.accelerant.ai.
Accelerant is hiring a Director, Security Operations: a senior team lead who owns the work that calls for security judgment and will report directly to the Chief Information Security Officer (CISO). This is a senior, hands-on role: you set technical direction for the security operations team, stay close to the work, and act as the CISO’s trusted deputy for technical security and security operations, including changes in the threat landscape, vulnerabilities and incidents.
You are responsible for the strategic direction of our technical security operations, controls and processes. That includes assessing the security of mergers and acquisitions, owning the penetration test cycle, coordinating purple team exercises and SOC coordination, and acting as the technical expert for projects. You’ll have the autonomy to drive technical initiatives from concept to delivery.
Key responsibilitiesThe Director, Security Operations owns the high-judgment security work and is accountable for results in five areas.
M&A security
• Lead security due diligence and post-close integration assessments as deal volume grows.
• Build and maintain a repeatable integration playbook: assessment checklist, risk scoring, remediation plan and day-one controls.
• Write clear risk narratives and recommendations for the CISO and deal teams.
Testing, detection and operations
• Lead the penetration test cycle: scoping, triage, remediation tracking and reporting to leadership.
• Own the SOC sync across Accelerant and Mission US/UK: shared priorities, escalation paths, handoffs and coverage gaps.
• Own the detection platform strategy, including Microsoft Sentinel cost and ingestion, without losing detection coverage.
Incident response and control improvement
• Act as incident response manager for technical incidents, leading the response from triage through to resolution.
• Own the technical incident response playbooks and keep them current.
• Lead lessons-learned reviews after incidents and recommend control changes, tracked through to completion.
• Run control reviews and recommend improvements where gaps appear.
• Act as the internal escalation point for the external SOC, advising on potential incidents that need more judgment.
Technical leadership and vendors
• Build and lead the security engineering team: partner with the CISO to hire direct reports, then provide line management and technical direction, including assigning work, reviewing output and coaching.
• Manage the security tooling and service vendors in this area, including the full vendor lifecycle: selection, renewals, performance and escalations.
• Step into hands-on engineering and investigation work when the team needs it.
Required qualificationsCandidates typically bring 6 to 9 years of security engineering experience.
• Breadth across cloud security, network security and detection engineering, with depth in Azure and Microsoft Sentinel.
• Experience leading incident response for technical incidents, including post-incident reviews.
• Experience assessing the security of acquisitions.
• Familiarity with modern identity and authentication, including passkeys and privileged access.
• Experience hiring, line-managing and developing security engineers.
• Able to write a clear risk narrative and present it to leadership.
• Sound judgment on ambiguous problems, and good prioritization across competing demands.
• Experience managing security vendor relationships.
• Willing to stay close to the technical work: this is not a pure management role.
Preferred qualificationsThese strengthen an application but are not required. Prior exposure to M&A security integration is the strongest differentiator.
• Experience assessing acquisition targets or integrating acquired companies, including building repeatable playbooks.
• Experience running a recurring penetration testing or automated pentest program and driving remediation.
• Experience coordinating a SOC or managed detection provider across multiple entities or regions.
• Experience with Microsoft Sentinel and SIEM cost optimization.
• Experience securing AWS environments and working with Cloudflare.
• Experience rolling out phishing-resistant authentication such as passkeys or FIDO2.
• Certifications such as CISSP, CISM, GIAC, AZ-500 or SC-200.
• Experience in insurance, financial services or another regulated industry.
Skills Required
- 6 to 9 years of security engineering experience
- Experience across cloud security, network security, and detection engineering
- Depth in Azure and Microsoft Sentinel
- Experience leading technical incident response and post-incident reviews
- Experience assessing the security of acquisitions
- Familiarity with modern identity and authentication, including passkeys and privileged access
- Experience hiring, line-managing, and developing security engineers
- Ability to write clear risk narratives and present them to leadership
- Sound judgment and prioritization across ambiguous, competing demands
- Experience managing security vendor relationships
- Willingness to remain hands-on with technical work
- Experience assessing acquisition targets or integrating acquired companies
- Experience building repeatable M&A security integration playbooks
- Experience running recurring penetration testing or automated penetration testing programs
- Experience coordinating a SOC or managed detection provider across multiple entities or regions
- Experience with Microsoft Sentinel and SIEM cost optimization
- Experience securing AWS environments and working with Cloudflare
- Experience implementing phishing-resistant authentication such as passkeys or FIDO2
- CISSP, CISM, GIAC, AZ-500, or SC-200 certification
- Experience in insurance, financial services, or another regulated industry
What We Do
Accelerant is unlike other insurance program carriers. We are fueled by insurance technology and supported by our unique insurance platform. We work exclusively with MGAs and Program Administrators. We’re transparent, responsive and collaborative. We’ve walked in your shoes and understand your challenges. And we’re organized and committed to your success, because we’re successful when you are too. Our technology fueled, data driven partnerships with specialty underwriters and risk capital partners propel new levels of profitability by: · Providing the entire value chain access to data and analytics to better understand risk and benefit from these insights · Offering long-term capacity commitments · Prioritizing velocity and collaboration while eliminating bureaucracy · Offering support to streamline operational and regulatory complexity We’ve built a network of some of the best MGA and Program Administrators on the planet. We call them Members because it underscores our deep commitment to their, and your, success. And we are always looking for other top-class Members.
