About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Notion, Cursor, Lovable, Replit, and Mercor, and Iru partners with industry leaders such as ServiceNow and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

The Opportunity

Iru is building a next-generation Security Operations function to support a modern SaaS platform spanning Identity, Endpoint Management, EDR, and cloud-native infrastructure.

We are seeking a SOC Manager to lead and mature a hybrid SOC model, combining internal capabilities with our MDR partner (Managed SOC Provider). This role is accountable for defining how security operations run at Iru—owning governance, detection strategy, incident response, and operational excellence.

You will act as the central owner of security operations, ensuring we have strong visibility, fast response, and continuous improvement across our environment.

Day To Day

SOC Governance & Operating Model

Define and operationalize the SOC mission, scope, and service boundaries
Establish a clear roles, responsibilities, and escalation hierarchy
Build and maintain a RACI model across internal teams and Managed SOC Provider
Own the effectiveness and maturity of Iru’s hybrid SOC model

Operational Ownership & Execution

Clearly define and enforce ownership across:
- Detection engineering
- Threat intelligence
- Tier 1 alert triage
- 24/7 monitoring
- Incident response leadership
- Threat hunting
- Escalation investigations
Establish and manage the “first call” model for security incidents at Iru
Serve as incident commander for high-severity events or delegate appropriately

MDR (Managed SOC Provider) Management

Own the operational relationship with Managed SOC Provider
Ensure alignment on:
- Alert triage quality and consistency
- Escalation thresholds and timelines
- Detection coverage across environments
- Incident response coordination
Hold Managed SOC Provider accountable to defined SLAs and performance expectations
Continuously improve MDR effectiveness through feedback loops and tuning

Detection Engineering

Build and maintain a central detection catalog
Align detections to MITRE ATT&CK where applicable
Partner with internal teams and Managed SOC Provider to:
- Develop new detections
- Tune and optimize existing rules
- Reduce false positives and noise
Ensure detection coverage across:
- Identity (Iru Identity, Entra)
- Endpoint (EM / EDR)
- Cloud (AWS)
- SaaS and integrations

Data & Telemetry Strategy

Maintain a complete inventory of all telemetry sources across:
- Endpoint, Identity, Cloud, Network, SaaS
For each data source:
- Define system owner
- Confirm ingestion into Panther SIEM
- Validate data quality and coverage
Drive onboarding of new log sources to close visibility gaps

Incident Response Framework

Design and maintain Iru’s incident response framework, including:
- Incident classification and severity model
- Evidence collection standards
- Containment and remediation procedures
- Recovery processes
- Post-incident review and lessons learned
Ensure consistent execution across internal teams and Managed SOC Provider

Runbooks & Playbooks

Develop and maintain:
- Alert triage procedures
- Investigation runbooks
- Incident response playbooks
Ensure all runbooks are actionable, tested, and continuously improved

Threat Intelligence & Hunting

Integrate threat intelligence into detection and response workflows
Define ownership model for threat intelligence (internal vs MDR)
Establish proactive threat hunting capabilities
Evaluate and integrate external threat hunting services as needed

SOC Metrics & Reporting

Define and track key SOC KPIs:
- Mean Time to Detect (MTTD)
- Mean Time to Respond (MTTR)
- Alert volume and trends
- False positive rates
- Detection coverage and gaps
Provide regular reporting to Security Leadership and executive stakeholders
Use metrics to drive SOC maturity and continuous improvement

Nice To Haves, But NOT Required

Prior experience helping mature or build a security operations program from the ground up.
Background in threat hunting or detection engineering.
Experience integrating Wiz or similar cloud posture management tools into a SIEM workflow.
Knowledge of security automation frameworks, including alert enrichment and workflow orchestration.
Hands-on experience supporting hybrid (Mac + Windows) endpoint environments.

Benefits & Perks

Competitive salary

Hybrid work environment (3 days in office per week)

100% individual and dependent medical + dental + vision coverage

401(K) with a 4% company match

20 days PTO

Iru Wellness Week the first week in July

Equity for full-time employees

In-office lunch stipend provided

Up to 16 weeks of paid leave for new parents

Paid Family and Medical Leave

Modern Health mental health benefits for individuals and dependents

Fertility benefits

Working Advantage employee discounts

Onsite fitness center

Free parking

Exciting opportunities for career growth

We are excited to be serving a significant need for a fast-growing market, and are proud of the high-performing team we have brought together so far. If you’re someone who wants to engage in new, exciting projects that will challenge your skills in the best way possible, we would love to connect with you.

At Iru, we believe in fostering an inclusive environment in which employees feel encouraged to share their unique perspectives, leverage their strengths, and act authentically. We know that diverse teams are strong teams, and welcome those from all backgrounds and varying experiences.

Iru is proud to be an equal opportunity employer committed to diversity and inclusion in the workplace. Qualified applicants will be considered for employment without regard to race, color, religion, national origin, age, sex, sexual orientation, gender identity, physical or mental disability, protected veteran or military status or any other status protected by applicable law.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

Iru jobs

SOC Manager

Never Miss a New Opportunity