Manager, Security Operations

Leads strategy and execution for Figma's security operations programme, building the systems, processes and tooling behind detection and response and shaping the future of its DART and SOC functions. The manager works alongside Security Engineering and Platform Security as well as IT, GRC and Legal, and can work from a US hub or remotely in the United States.

The role owns security monitoring and incident response from detection engineering through post-incident review. That includes automating alert triage, enrichment, investigation and response with SOAR and custom tools, maintaining runbooks, escalation procedures and communication plans for incidents of every severity, and running preparedness work such as tabletop exercises, red team engagements and capability assessments. The manager tunes the SIEM and SOAR platforms to cut noise and close coverage gaps, builds threat intelligence capability to guide investment, and supports Legal, Privacy and Communications on breach notification and regulatory response during serious incidents. Vendor management, operational metrics and cross-team efforts touching IAM, vulnerability management, DLP and exposure reduction also sit with the role.

Figma wants seven or more years in security operations, incident response or related security engineering, hands-on experience automating detection and response with scripting and APIs, deep SIEM and SOAR expertise in cloud or SaaS environments, a record of building or improving a detection and response programme, and experience leading complex incidents with legal and business partners. Public-company compliance experience and AI risk frameworks are pluses.