Celonis is the global leader in Process Intelligence and the pioneer of Process Mining technology. As one of the world’s fastest-growing enterprise SaaS companies, we are changemakers pushing the boundaries of what’s possible. We invest heavily in advanced AI capabilities—specifically our Process Intelligence Graph—to turn data insights into immediate business action. We believe there is a massive opportunity to unlock global productivity and sustainability by placing intelligence at the core of every business process. Join our mission to make processes work for people, companies, and the planet.
Celonis is seeking a Manager of Global Cyber Defense to lead our Security Operations (SecOps) and Incident Response teams. In this global leadership position, you will be the primary architect and custodian of the strategies, tools, and policies that safeguard Celonis’s enterprise data, corporate infrastructure, and cloud-native environments.
Your team will ensure the security and integrity of our global execution management platform, protecting the critical business processes of our customers. By designing and deploying advanced technical controls, you will ensure that emerging cyber threats are automatically detected, isolated, and neutralized. As a core security leader, you will collaborate across Engineering, Product, and IT to build a resilient, security-first culture, integrating deep threat insights directly into our continuous software development lifecycle.
While this is a management role, Celonis values expert practitioners. You should be ready to lead by example, bring deep technical mastery of modern security ecosystems, and blend proprietary and open-source tooling into a seamless, next-generation global defense strategy. This position reports VP of Information Security.
What You Will Do in This Role
- Lead and Scale: Recruit, mentor, and develop a high-performing global team of cyber defense engineers and security analysts.
- Define Standards: Author and maintain enterprise-wide cyber defense frameworks, incident response playbooks, and operational blueprints.
- Drive SOC Evolution: Own the strategic architecture, tooling, and day-to-day operations of our modern Security Operations Center (SOC).
- Threat Mitigation: Oversee the rapid identification, containment, and remediation of advanced cyber attacks and vulnerabilities.
- Tooling Innovation: Evaluate, select, and integrate cutting-edge security technologies, focusing on automation (SOAR), telemetry, and SIEM optimization.
- Proactive Defense: Champion threat modeling, breach simulations, and tabletop exercises across Engineering, Cloud Infrastructure, and IT.
- Cultivate Enablement: Partner with internal learning teams to institutionalize security playbooks and upskill teams across the organization.
- Metrics and Accountability: Establish, track, and report on high-impact cyber defense KPIs to provide visibility to executive leadership.
- Agile Execution: Manage the Cyber Defense roadmap within an agile engineering framework to ensure predictable, high-velocity security delivery.
- Threat Combat Experience: A proven track record of successfully mitigating advanced persistent threats (APTs) and sophisticated cyber adversaries.
- SOC Architecture Mastery: In-depth, foundational knowledge of SOC design, including advanced logging strategies, network segmentation, cloud telemetry, and honeypots.
- Cloud & SaaS Expertise: Strong technical understanding of securing enterprise SaaS platforms and cloud environments (AWS, Azure, or GCP).
- Automation-First Mindset: Demonstrated ability to build, automate, and orchestrate effective incident response workflows to minimize blast radiuses.
- Framework Familiarity: Strong working knowledge of security risk management and threat frameworks (e.g., NIST CSF, MITRE ATT&CK).
- Academic Foundation: A strong academic background with a Bachelor’s degree in Computer Science, STEM, or a compelling narrative of equivalent real-world technical experience.
- Leadership and Drive: Proven capability to manage technical teams, manage high-pressure situations, and consistently exceed operational goals.
- Executive Communication: Exceptional English communication skills, with the confidence to deliver transparent, data-driven security metrics to the CISO and executive board.
- Hybrid Security Background: Hands-on experience spanning both offensive (red teaming/penetration testing) and defensive (blue teaming) disciplines.
- Data-Driven Security: Familiarity with leveraging data analytics, SIEM engineering, or process-oriented workflows to optimize security operations.
- Industry Certifications: Relevant elite certifications such as CISSP, CISM, or GIAC.
- Enterprise Endpoint Security: Experience managing and securing corporate endpoint fleets at a global scale.
What Celonis can offer you:
- Pioneer Innovation: Work with the global leader in Process Mining and the Process Intelligence Graph to shape the future of AI-driven business operations.
- Ownership from Day 1: Every full-time "Celonaut" is an owner, receiving Restricted Stock Units (RSUs) and merit-based refresh grants.
- Unrivaled Family Support: Benefit from our inclusive parental leave policy—24 weeks of fully paid leave for primary carers and 12 weeks for supporting carers, available from your first day of employment.
- Work-Life Integration: Enjoy Unlimited PTO (in applicable regions) and generous PTO globally, as well as a flexible hybrid work model that balances remote focus with vibrant office collaboration.
- Continuous Growth: Elevate your skills through our 70-20-10 learning framework, mentorship programs, and access to a dedicated learning platform.
- Holistic Well-being: Prioritize your health with subsidized Wellhub memberships, mental health counseling, and dedicated "Wellness Weeks" that prioritize work/life balance.
- Drive Sustainability: Participate in annual Impact Days, where you receive paid time off to volunteer for community and environmental causes with your local office, or virtually.
- Global Inclusion & Belonging: Find community through our Inclusion Think Tank and participate in our annual Inclusion Days, ensuring every voice is heard and valued.
- Value-Driven Impact: Join a mission-led organization where our core values—Live for Customer Value, The Best Team Wins, We Own It, and Earth Is Our Future—drive every decision.
About Us:
Celonis makes processes work — for people, companies, and the planet. Powered by process mining and AI, the Celonis Process Intelligence Platform integrates process data and business context to create a living digital twin of business operations. We enable thousands of companies worldwide to understand how their business actually runs and, together with their partners, build intelligent solutions that transform and continuously improve the way they operate — unlocking billions in value. Celonis is headquartered in Munich, Germany, and New York City, USA, with more than 20 offices worldwide.
Get familiar with the Celonis Process Intelligence Platform by watching this video.
Celonis Inclusion Statement:
At Celonis, we believe our people make us who we are and that “The Best Team Wins”. We know that the best teams are made up of people who bring different perspectives to the table. And when everyone feels included, able to speak up and knows their voice is heard - that's when creativity and innovation happen.
Your Privacy:
Any information you submit to Celonis as part of your application will be processed in accordance with Celonis’ Accessibility and Candidate Notices
By submitting this application, you confirm that you agree to the storing and processing of your personal data by Celonis as described in our Privacy Notice for the Application and Hiring Process.
Please be aware of common job offer scams, impersonators and frauds. Learn more here.
Skills Required
- Proven experience mitigating advanced persistent threats (APTs) and sophisticated adversaries
- Deep knowledge of SOC design, advanced logging strategies, network segmentation, cloud telemetry, and honeypots
- Strong technical understanding of securing enterprise SaaS platforms and cloud environments (AWS, Azure, or GCP)
- Demonstrated ability to build, automate, and orchestrate incident response workflows (SOAR/automation-first)
- Working knowledge of security frameworks and threat models (NIST CSF, MITRE ATT&CK)
- Bachelor's degree in Computer Science, STEM, or equivalent real-world technical experience
- Proven capability to manage technical teams and perform in high-pressure incident situations
- Excellent English communication skills and ability to present security metrics to executive leadership
- Hands-on experience in both offensive and defensive disciplines (red teaming, penetration testing)
- Familiarity with SIEM engineering, security data analytics, and process-oriented security workflows
- Relevant certifications (CISSP, CISM, GIAC)
- Experience managing enterprise endpoint security at global scale
What the Team is Saying
Celonis Compensation & Benefits Highlights
-
Parental & Family Support — Policies provide day‑one eligibility with 24 weeks of fully paid leave for primary carers and 12 weeks for supporting carers, including adoptions. Feedback suggests this is a standout, recently revamped program positioned in a top‑tier bracket.
-
Equity Value & Accessibility — All full‑time employees receive equity grants with annual refreshes and merit awards, and an “education kicker” grant is offered for each child born to or adopted by an employee. This breadth suggests accessible ownership with ongoing potential value.
-
Leave & Time Off Breadth — Offerings include unlimited PTO in applicable regions, generous global PTO, paid holidays and sick days, wellness days, and paid Impact Days for volunteering. Hybrid work and flexibility further support time away.
Celonis Insights
What We Do
Celonis makes processes work — for people, companies, and the planet. Powered by process mining and AI, the Celonis Process Intelligence Platform integrates process data and business context to create a living digital twin of business operations. We enable thousands of companies worldwide to understand how their business actually runs and, together with their partners, build intelligent solutions that transform and continuously improve the way they operate — unlocking billions in value. Celonis is headquartered in Munich, Germany, and New York City, USA, with more than 20 offices worldwide. # Approximately half of the top 200 companies of the Forbes Global 2000 are Celonis customers. # More than 30% of the Fortune Global 500, and more than 25% of the Fortune 500 are Celonis customers. # To date, Celonis customers have realized more than $8 billion in value, and identified more than $18 billion in value. Celonis has been recognized as: # Germany’s most valuable startup and one of the most valuable in New York City # One of the world’s 50 most valuable private companies # The first German decacorn and one of only 48 in the world # The second largest unicorn in Europe
Why Work With Us
Celonis is a dynamic, fast-paced, and rewarding place to work. Proudly calling ourselves Celonauts, we are innovators and change-makers who challenge the status quo. We tackle challenges together and celebrate our successes as a team in and out of the office. Together, we’re changing the world one process at a time. Care to join us?
Gallery
Celonis Teams
Celonis Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Celonis offers a hybrid work policy, blending remote work flexibility with in-office collaboration. Employees enjoy the comfort of working from home while benefiting from teamwork and connection in our modern office spaces.
