Director, Security Operations (Security Engineering)

As the world’s pioneering local delivery platform, our mission is to deliver an amazing experience, fast, easy, and to your door. We operate in around 65 countries worldwide, powered by tech, designed by people. As one of Europe’s largest tech platforms, headquartered in Berlin, Germany, Delivery Hero has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index. We push hard, learn quickly and stay human along the way. It’s this wonderful mix of high performance and real community that makes Delivery Hero a place where ambition and belonging grow side by side. If you’re curious, collaborative and ready to dive deep into meaningful work, you’ll fit right in. Clear goals. Strong teams. Real results. As Director, Security Operations, you’ll set the direction for how Delivery Hero detects, investigates and responds to threats across every entity and platform. You’ll move our CSIRT and SOC teams from baseline monitoring to an intelligence-driven, proactive defense, built on Google SecOps. You’ll report to the CISO and be the person who leads when a critical incident hits. You’ll lead our existing CSIRT and SOC teams, based at our global headquarters in Berlin, and scale capabilities where needed. You’ll work closely with local CISOs and security leads to give millions of daily customers one consistent standard of protection. Lead the CSIRT and SOC managers and their teams: set clear expectations, give 360 feedback and build an engaging, diverse place to work. Set the strategy for security operations and run an OKR and roadmap process that aligns threat detection, incident response and threat intelligence. Modernize detection and response with Google SecOps (SIEM) and advanced telemetry, turning threat actor TTPs into high-fidelity detections that cut noise and reduce MTTD and MTTR. Coach teams to excellent incident handling and act as incident commander for critical incidents, owning stakeholder communication and post-incident follow-up. Partner with local CISOs and security leads across all entities to set consistent monitoring and incident response standards. Use data to diagnose issues and show measurable risk reduction against MITRE ATT&CK, with diligent budget governance. Proven leadership of Security Operations Centers (SOC) and Incident Response (CSIRT) functions in large, complex enterprise or tech environments, balancing day-to-day incident demands with long-term improvements. Deep experience managing complex, critical security incidents and building proactive threat hunting programs. Strong working knowledge of modern cloud-native SIEM and SecOps platforms, including telemetry ingestion, detection-as-code and automated response playbooks (SOAR). Clear communication and crisis management skills, turning complex technical incidents into actionable risk insights for executives, regional CISOs and legal partners. Proven success recruiting, retaining and growing senior engineers and managers, including managers of managers, and running global follow-the-sun or escalation models. Experience setting and driving security operations metrics, such as MTTD, MTTR and detection coverage against MITRE ATT&CK. Nice to have Experience operating within complex global platforms, food or logistics delivery networks, or multi-tenant cloud ecosystems. Certifications such as CISSP, CISM, or advanced GIAC credentials (GCIH, GCFA, GNFA). Experience monitoring and responding to threats across multi-cloud environments (AWS, GCP). — Published by Delivery Hero. Apply on the employer's own posting.