Vice President, Security Operations Engineer

Oaktree is a leader among global investment managers specializing in alternative investments, with over $200 billion in assets under management. The firm emphasizes an opportunistic, value-oriented and risk-controlled approach to investments in credit, private equity, real assets and listed equities. The firm has over 1400 employees and offices in 25 cities worldwide.

We are committed to cultivating an environment that is collaborative, curious, inclusive and honors diversity of thought. Providing training and career development opportunities and emphasizing strong support for our local communities through philanthropic initiatives are essential to our culture.

For additional information please visit our website at

.

Role Summary

We are seeking a Vice President, Security Operations Engineer to lead and actively contribute to the strategy, execution, and continuous improvement of our global detection and response capabilities. This leader will set direction and governance for security operations while remaining hands-on in key areas such as incident response, SIEM tuning, and threat analysis when needed.

Key Responsibilities

• Strategic Leadership & Governance

• Assist with defining and execution of the Security Operations strategy, ensuring alignment with enterprise risk and regulatory requirements.

• Provide regular reporting to senior leadership and the board on threat trends, incident readiness, and operational metrics.
• Establish governance over incident response, threat management, and monitoring functions.

• Security Monitoring & SIEM Engineering

• Actively engage in SIEM platform design, configuration, and tuning to ensure high-fidelity detections.

• Develop and optimize detection rules, alerts, and dashboards to minimize false positives and increase fidelity.
• Integrate telemetry form cloud, endpoint, application, and network sources.
• Build automation (SOAR, scripts, APIs) to enhance correlation and response.

• Incident Response & Forensics

• Lead major incident investigations, from detection through containment and remediation.

• Perform host and network forensics, log analysis, and malware analysis.
• Develop and maintain incident response runbooks and playbooks for common attack scenarios (ransomware, phishing, insider threats, vendor compromise).
• Conduct root cause analysis and recommend engineering fixes to prevent recurrence.

• Threat Hunting & Vulnerability Operations

• Direct proactive threat hunting and participate in hunts for advanced or high-priority cases.

• Correlate threat intelligence with internal telemetry to identify potential risks.
• Partner with infrastructure and application teams to validate and remediate vulnerabilities.
• Conduct attack simulations and red/blue team exercises to improve readiness.

• Integration & Engineering

• Oversee partnerships with MSSPs and technology vendors; validate detection quality and escalation workflows.

• Engineer integrations across security tools (SIEM, SOAR, EDR/XDR, IAM, cloud monitoring).
• Automate workflows with scripting (Python, PowerShell, Bash) and Infrastructure-as-Code (Terraform, Ansible).
• Evaluate new security technologies and develop POCs to strengthen detection and response capabilities.

• Collaboration

• Work closely with service providers to validate alerts, improve detection coverage, and ensure effective escalation.

• Foster collaboration with IT, DevOps, and application teams to embed logging, monitoring, and response requirements early in the lifecycle.
• Mentor junior analysts/engineers by sharing technical knowledge and investigation techniques.

Qualifications

• Experience: 15+ years in cybersecurity operations/engineering, with at least 3-5 years in a leadership role that combined hands-on technical responsibilities.

• Technical Skills:

• Expert-level SIEM engineering (Splunk, QRadar, Sentinel, or equivalent).

• Advanced knowledge of forensics, malware analysis, and incident response.
• Hands-on EDR/XDR platforms (CrowdStrike, SentinelOne, Carbon Black, etc.).
• Familiarity with cloud security (AWS, Azure, GCP) and modern EDR/XDR platforms.
• Proficiency with scripting and automation (Python, PowerShell, Bash) strongly preferred.
• Industry Knowledge: Financial services or other highly regulated industries strongly preferred.
• Education: Bachelor's or Master's degree in information security, Computer Science, or related technical discipline.

Bonus Qualifications

• Advanced technical certifications such as CISSP, GIAC, CISM, CEH, OSCP, or equivalent.

Equal Opportunity Employment Policy

Oaktree is committed to diversity and to equal opportunity employment. Oaktree does not make employment decisions on the basis of race, creed, color, ethnicity, national origin, citizenship, religion, sex, sexual orientation, gender identity, gender expression, age, past or present physical or mental disability, HIV status, medical condition as defined by state law (genetic characteristics or cancer), pregnancy, childbirth and related medical conditions, veteran status, military service, marital status, familial status, genetic information, domestic violence victim status or any other classification protected by applicable federal, state and local laws and ordinances. This policy applies to hiring, placement, internal promotions, training, opportunities for advancement, recruitment advertising, transfers, demotions, layoffs, terminations, recruitment advertising, rates of pay and other forms of compensation and all other terms, conditions and privileges of employment. This policy applies to all Oaktree applicants, employees, clients, and contractors. Staff members wishing to report violations or suspected violations of this policy should contact the head of their department or Human Resources.

For positions based in Los Angeles

For those applying for a position in the city of Los Angeles, the firm will consider for employment qualified applicants with a criminal history in a manner consistent with applicable federal, state and local law.