Manager of Global Cyber Defense

Celonis is the trusted platform to industrialize Enterprise AI. At our core is the Celonis Context Model — which combines process data, business knowledge, and intelligence into a living digital twin of the enterprise that AI can actually understand, turning AI's operational blind spots into operational clarity. World's leading companies trust Celonis and its global ecosystem of partners to make their AI agents, people, systems, and processes work together, achieving transformational outcomes. We believe there's a massive opportunity to unlock global productivity and sustainability by giving AI the context to understand how every business process really works. Join our mission to make processes work for people, companies, and the planet. About the Role Celonis is seeking a Manager of Global Cyber Defense to lead our Security Operations (SecOps) and Incident Response teams. In this global leadership position, you will be the primary architect and custodian of the strategies, tools, and policies that safeguard Celonis’s enterprise data, corporate infrastructure, and cloud-native environments. Your team will ensure the security and integrity of our global execution management platform, protecting the critical business processes of our customers. By designing and deploying advanced technical controls, you will ensure that emerging cyber threats are automatically detected, isolated, and neutralized. As a core security leader, you will collaborate across Engineering, Product, and IT to build a resilient, security-first culture, integrating deep threat insights directly into our continuous software development lifecycle. While this is a management role, Celonis values expert practitioners. You should be ready to lead by example, bring deep technical mastery of modern security ecosystems, and blend proprietary and open-source tooling into a seamless, next-generation global defense strategy. This position reports VP of Information Security. What You Will Do in This Role • Lead and Scale: Recruit, mentor, and develop a high-performing global team of cyber defense engineers and security analysts. • Define Standards: Author and maintain enterprise-wide cyber defense frameworks, incident response playbooks, and operational blueprints. • Drive SOC Evolution: Own the strategic architecture, tooling, and day-to-day operations of our modern Security Operations Center (SOC). • Threat Mitigation: Oversee the rapid identification, containment, and remediation of advanced cyber attacks and vulnerabilities. • Tooling Innovation: Evaluate, select, and integrate cutting-edge security technologies, focusing on automation (SOAR), telemetry, and SIEM optimization. • Proactive Defense: Champion threat modeling, breach simulations, and tabletop exercises across Engineering, Cloud Infrastructure, and IT. • Cultivate Enablement: Partner with internal learning teams to institutionalize security playbooks and upskill teams across the organization. • Metrics and Accountability: Establish, track, and report on high-impact cyber defense KPIs to provide visibility to executive leadership. • Agile Execution: Manage the Cyber Defense roadmap within an agile engineering framework to ensure predictable, high-velocity security delivery. What We Are Looking For • Threat Combat Experience: A proven track record of successfully mitigating advanced persistent threats (APTs) and sophisticated cyber adversaries. • SOC Architecture Mastery: In-depth, foundational knowledge of SOC design, including advanced logging strategies, network segmentation, cloud telemetry, and honeypots. • Cloud & SaaS Expertise: Strong technical understanding of securing enterprise SaaS platforms and cloud environments (AWS, Azure, or GCP). • Automation-First Mindset: Demonstrated ability to build, automate, and orchestrate effective incident response workflows to minimize blast radiuses. • Framework Familiarity: Strong working knowledge of security risk management and threat frameworks (e.g., NIST CSF, MITRE ATT&CK). • Academic Foundation: A strong academic background with a Bachelor’s degree in Computer Science, STEM, or a compelling narrative of equivalent real-world technical experience. • Leadership and Drive: Proven capability to manage technical teams, manage high-pressure situations, and consistently exceed operational goals. • Executive Communication: Exceptional English communication skills, with the confidence to deliver transparent, data-driven security metrics to the CISO and executive board. Preferred Qualifications • Hybrid Security Background: Hands-on experience spanning both offensive (red teaming/penetration testing) and defensive (blue teaming) disciplines. • Data-Driven Security: Familiarity with leveraging data analytics, SIEM engineering, or process-oriented workflows to optimize security operations. • Industry Certifications: Relevant elite certifications such as CISSP, CISM, or GIAC. • Enterprise Endpoint Security: Experience managing and securing corporate endpoint fleets at a global scale. What Celonis can offer you: • Pioneer Innovation: Work with the global leader in Process Mining and the Process Intelligence Graph to shape the future of AI-driven business operations. • Ownership from Day 1: Every full-time "Celonaut" is an owner, receiving Restricted Stock Units (RSUs) and merit-based refresh grants. • Unrivaled Family Support: Benefit from our inclusive parental leave policy—24 weeks of fully paid leave for primary carers and 12 weeks for supporting carers, available from your first day of employment. • Work-Life Integration: Enjoy Unlimited PTO (in applicable regions) and generous PTO globally, as well as a flexible hybrid work model that balances remote focus with vibrant office collaboration. • Continuous Growth: Elevate your skills through our 70-20-10 learning framework, mentorship programs, and access to a dedicated learning platform. • Holistic Well-being: Prioritize your health with subsi