Security Operations Lead

ABOUT PELICO

Traditional industrial manufacturing systems were built for predictability. Supply chains no longer are. Today, real-time data is buried in legacy tools that weren't designed for constant disruption. By the time an issue surfaces, it has already snowballed, sending everyone into firefighting mode. Pelico exists to close the gap between production plans and the daily reality on the factory floor.

We've built the manufacturing orchestration platform trusted by the world's most complex industrial operations : companies like Airbus, Boeing, Safran, Eaton, and Cartier. Our AI connects fragmented supply chain, production, and quality data into a single live operational picture — then puts AI agents to work anticipating disruptions, simulating recovery options, and keeping every team aligned before small problems become expensive ones.

Founded in 2019 and backed by General Catalyst, 83North, and Serena, we've raised $72M and are growing fast — 300% year-over-year revenue growth, deployed in 15+ countries, and supporting factories worldwide. We're headquartered in Paris, with offices in Miami, London and Amsterdam, and we're just getting started.

This is a rare chance to join a company that's redefining an industry that hasn't been disrupted in decades — from the inside.

ABOUT THE ROLE

As SecOps Lead, you'll own the operational effectiveness of Pelico's security monitoring, incident response, and vulnerability management capabilities. You'll turn security alerts and findings into actionable investigations, prioritized remediation, and measurable risk reduction — building the security operations foundation needed to protect our platform, support enterprise customers, and enable future regulated deployments.

This is a hands-on technical leadership role. You'll work closely with the CISO, Engineering, IT, and external security partners to build reliable, scalable security operations without creating unnecessary friction for product development and delivery.

WHAT YOU'LL DO

- Own security monitoring, detection, and incident response. Implement and operate SIEM and SOAR capabilities alongside our managed Security Operations Center (SOC). Ensure reliable telemetry across cloud, application, and identity environments; build and tune detections for account compromise, privilege escalation, suspicious cloud activity, and data exfiltration; and establish dependable 24/7 monitoring and escalation processes. - Lead security investigations and response readiness. Develop incident response playbooks and automate enrichment, triage, and repeatable response actions. Lead technical investigations with Engineering, IT, and external providers, establish appropriate approval gates for disruptive actions, exercise response plans, and translate lessons learned into practical improvements. - Own vulnerability management and CNAPP operations. Deploy and operate a Cloud-Native Application Protection Platform (CNAPP) across in-scope cloud assets, workloads, containers, and code repositories. Prioritize findings based on exploitability, exposure, asset criticality, and attack-path context — not severity scores alone — and bring cloud, code, dependency, secrets, and independent testing findings into a single actionable remediation workflow. - Drive accountable remediation and security testing. Partner with Engineering to assign remediation owners, establish deadlines, verify fixes, manage remediation SLAs, and escalate overdue risks. Coordinate urgent mitigations for actively exploited vulnerabilities, maintain time-bound risk exceptions approved by the CISO, and address recurring root causes through secure defaults and automation. Plan penetration tests with qualified external providers and evaluate AI-powered agentic penetration testing capabilities with explicit authorization, controlled scope, human oversight, and appropriate data safeguards. - Strengthen cloud security and secure delivery. Partner with Engineering to improve cloud IAM, secrets management, network exposure, encryption, logging, and secure configuration, including protective controls such as a production WAF. Embed code, dependency, container, and secrets checks into CI/CD and infrastructure-as-code workflows, establish practical risk-based release gates, and contribute to threat modeling and security reviews for significant architecture changes, integrations, AI use cases, and customer deployments. - Build operational assurance and regulated readiness. Maintain security runbooks, coverage inventories, and evidence of operational controls in partnership with the CISO and GRC. Support ISO 27001, SOC 2, enterprise customer assurance, and future US regulated deployments through appropriate logging, access controls, vulnerability remediation, incident coordination, and controlled releases. Maintain defined data and access boundaries, ensuring regulated customer data stays out of unauthorized tools and environments.