Security Operations Lead

ABOUT PELICO Traditional industrial manufacturing systems were built for predictability. Supply chains no longer are. Today, real-time data is buried in legacy tools that weren't designed for constant disruption. By the time an issue surfaces, it has already snowballed, sending everyone into firefighting mode. Pelico exists to close the gap between production plans and the daily reality on the factory floor. We've built the manufacturing orchestration platform trusted by the world's most complex industrial operations : companies like Airbus, Boeing, Safran, Eaton, and Cartier. Our AI connects fragmented supply chain, production, and quality data into a single live operational picture — then puts AI agents to work anticipating disruptions, simulating recovery options, and keeping every team aligned before small problems become expensive ones. Founded in 2019 and backed by General Catalyst, 83North, and Serena, we've raised $72M and are growing fast — 300% year-over-year revenue growth, deployed in 15+ countries, and supporting factories worldwide. We're headquartered in Paris, with offices in Miami, London and Amsterdam, and we're just getting started. This is a rare chance to join a company that's redefining an industry that hasn't been disrupted in decades — from the inside. ABOUT THE ROLE As SecOps Lead, you'll own the operational effectiveness of Pelico's security monitoring, incident response, and vulnerability management capabilities. You'll turn security alerts and findings into actionable investigations, prioritized remediation, and measurable risk reduction — building the security operations foundation needed to protect our platform, support enterprise customers, and enable future regulated deployments. This is a hands-on technical leadership role. You'll work closely with the CISO, Engineering, IT, and external security partners to build reliable, scalable security operations without creating unnecessary friction for product development and delivery. WHAT YOU'LL DO - Own security monitoring, detection, and incident response. Implement and operate SIEM and SOAR capabilities alongside our managed Security Operations Center (SOC). Ensure reliable telemetry across cloud, application, and identity environments; build and tune detections for account compromise, privilege escalation, suspicious cloud activity, and data exfiltration; and establish dependable 24/7 monitoring and escalation processes. - Lead security investigations and response readiness. Develop incident response playbooks and automate enrichment, triage, and repeatable response actions. Lead technical investigations with Engineering, IT, and external providers, establish appropriate approval gates for disruptive actions, exercise response plans, and translate lessons learned into practical improvements. - Own vulnerability management and CNAPP operations. Deploy and operate a Cloud-Native Application Protection Platform (CNAPP) across in-scope cloud assets, workloads, containers, and code repositories. Prioritize findings based on exploitability, exposure, asset criticality, and attack-path context — not severity scores alone — and bring cloud, code, dependency, secrets, and independent testing findings into a single actionable remediation workflow. - Drive accountable remediation and security testing. Partner with Engineering to assign remediation owners, establish deadlines, verify fixes, manage remediation SLAs, and escalate overdue risks. Coordinate urgent mitigations for actively exploited vulnerabilities, maintain time-bound risk exceptions approved by the CISO, and address recurring root causes through secure defaults and automation. Plan penetration tests with qualified external providers and evaluate AI-powered agentic penetration testing capabilities with explicit authorization, controlled scope, human oversight, and appropriate data safeguards. - Strengthen cloud security and secure delivery. Partner with Engineering to improve cloud IAM, secrets management, network exposure, encryption, logging, and secure configuration, including protective controls such as a production WAF. Embed code, dependency, container, and secrets checks into CI/CD and infrastructure-as-code workflows, establish practical risk-based release gates, and contribute to threat modeling and security reviews for significant architecture changes, integrations, AI use cases, and customer deployments. - Build operational assurance and regulated readiness. Maintain security runbooks, coverage inventories, and evidence of operational controls in partnership with the CISO and GRC. Support ISO 27001, SOC 2, enterprise customer assurance, and future US regulated deployments through appropriate logging, access controls, vulnerability remediation, incident coordination, and controlled releases. Maintain defined data and access boundaries, ensuring regulated customer data stays out of unauthorized tools and environments. ABOUT YOU - Strong hands-on experience in security operations, cloud security, or DevSecOps, with direct ownership of production security capabilities. - Experience deploying and operating SIEM solutions, building and tuning detections, investigating alerts, and partnering with an internal or managed SOC. - Practical experience with SOAR or security automation, including integrations, enrichment, and safe response workflows. - Experience operating a CNAPP or equivalent cloud and workload security tooling, with a track record of driving findings through remediation and verifying fixes. - Solid understanding of cloud IAM, networking, logging, containers, Kubernetes, and infrastructure as code, including how misconfigurations and vulnerabilities combine to create exploitable attack paths. - Familiarity with secure SDLC practices, CI/CD, dependency and container scanning, secrets detection, and vulnerability remediation. - Ability to automate security workflows using Python, shell scripting, APIs, or equivalent tools. - Experience coordinating technical incident response and communicating clearly under pressure, with sound judgment around containment, escalation, and approval requirements. - Ability to influence Engineering teams, translate technical findings into practical fixes, and balance security urgency with business and operational constraints. - Strong written communication in English, disciplined documentation, and comfort working across US and European teams. - You actively embrace AI tools as part of how you work — curious about what's possible and quick to adopt new ways of working smarter and faster. - Hands-on experience with AI-assisted workflows and a genuine interest in staying at the frontier of what these tools can do. Nice to have - Experience with Azure security and cloud-native production environments. - Experience supporting ISO 27001, SOC 2, enterprise customer security requirements, or independent security testing programs. - Familiarity with US defense-related requirements such as DoD IL5, NIST SP 800-171, CMMC, or ITAR, including shared-responsibility models and controlled-data boundaries. - Experience building a security operations capability in a growing SaaS company. WHY PELICO We're building something genuinely hard and genuinely important. Here's what that comes with: - Meaningful equity — you're building this with us, so you'll own a piece of it. - Competitive salary benchmarked to your market. - Flexible, hybrid work model — we care about output, not face time. - Health, dental, and vision coverage. - Opportunity to work with some of the world's most complex and fascinating manufacturing operations. - A team that takes the work seriously without taking themselves too seriously. Pelico is an equal opportunity employer. We're committed to building a diverse team and an inclusive environment where everyone can do their best work.