Platform Security Operations Manager (CSIRT)

About the role

Firmus runs large-scale AI infrastructure based on GPU rack-scale systems, and the Platform Security Operations Manager leads the Platform Security team and manages the AI Factory's Computer Security Incident Response Team (CSIRT). The CSIRT detects, responds to and recovers from security incidents across AI FactoryOS, Firmus AI Cloud, the platforms built on them and tenant workloads, and runs the security controls that keep the estate defensible. The role is hands-on security leadership, managing the 24/7 on-call roster, incident plans, playbooks and exercises, and coordinating with incident command and Cyber Security and Operations leadership.

Key responsibilities

• Lead and manage the Platform Security team across regions, including hiring, onboarding, performance, development and wellbeing.
• Manage the CSIRT and its 24/7 on-call roster, and the incident response plan with severity classification and escalation paths.
• Lead live incident responses: triage, containment, eradication and recovery, and keep leadership informed with clear assessments.
• Manage incident playbooks, run regular exercises and tabletop tests, and handle evidence and chain of custody, bringing in external forensics when needed.
• Lead post-incident reviews, close fixes through problem management and engineering backlogs, and work with vendor security teams on product faults and vulnerabilities.
• Track vulnerabilities and threat intelligence for GPU infrastructure, Kubernetes, the identity stack and used products, and agree priorities and timeframes with the teams applying fixes.
• Manage runtime detection and enforcement, security gates in the delivery pipeline, Kubernetes estate policies, and the security exception register with compensating controls.
• Monitor privileged activity independently, provide security evidence for audit and customer due diligence, and keep the team's detection and forensics tooling fit for purpose.

Required profile

• Significant experience leading a CSIRT in a 24/7 production environment, including incident response plans, playbooks and exercises.
• Hands-on technical security background in large-scale on-premises and self-hosted infrastructure (bare-metal servers, Linux, Kubernetes, network security, identity, privileged access, runtime detection).
• Experience operating security controls under ISO 27001, SOC 2 or NIST frameworks and producing evidence for audits and due diligence.
• Clear communication under pressure, able to brief leadership during an incident and make containment calls with incomplete information.
• Preferred: experience securing multi-tenant GPU/HPC infrastructure and AI workloads, multi-tenant service provider or colocation experience, digital forensics on bare-metal Linux and containers, incident response frameworks such as NIST SP 800-61 and the FIRST CSIRT services framework, and certifications such as GCIH, GCFA, CISSP, CISM or a Kubernetes security credential. A Bachelor's degree in computer science, engineering, cyber security or a related discipline, or equivalent experience and training.

Required skills

• Security monitoring, detection and case management tooling (SIEM platforms, eBPF-based tools such as Falco or Tetragon)
• Jira Service Management or ServiceNow