Sr. Manager, Security Operations in Santa Clara, California at SiTime Corporation

About SiTime

SiTime is the Precision Timing company.

Timing is the heartbeat of all electronics, ensuring performance, resilience and scalability. For decades, quartz devices, non-silicon technology, have kept systems in sync, but they struggle in harsher, more demanding environments. MEMS-based Precision Timing delivers greater accuracy, smaller size and resilience. Today, MEMS timing powers over 400 applications, including high-growth ones in AI datacenters, automated driving, industrial and humanoid robots, wearables and IoT.

Our semiconductor MEMS programmable solutions offer a rich feature set that enables customers to differentiate their products with higher performance, smaller size, lower power, and better reliability. With more than 4 billion devices shipped, SiTime is changing the timing industry. For more information, visit: www.sitime.com.

Job Summary

Reporting to the CISO, this role leads Security Operations, one of three functions in SiTime's Security Organization. It owns detection and monitoring, the 24x7 managed detection and response relationship, threat hunting, incident response and ransomware readiness — the detect and respond function of the security organization.

This is a build role. The candidate will mature and scale the SIEM and log coverage standard, select and operate the MDR partner, establish detection use cases for the threats that matter to a fabless semiconductor company, and take the incident response and ransomware playbooks from draft to rehearsed.

Detection and response are only as strong as the platforms and data beneath them. The role partners closely with Security Engineering and Vulnerability Management to build SiTime's detection and response platform capabilities, and to enrich log data with the context detections depend on, such as asset criticality, owner, identity, and vulnerability exposure, so that detection coverage is comprehensive and every alert can be acted on quickly.

It is also a people-leadership role. The candidate starts hands-on, then scales the function through a mix of full-time hires, managed service capacity and specialist contractors engaged for surge and testing cycles.

This is an accountable owner role, not an advisory one. The role's core responsibility is to detect, triage, contain, and recover from security threats before they cause material harm to SiTime, and to keep the company ready to respond at any hour. The role partners with IT, Engineering, Legal, and the business, and with the Security Organization's other two functions:

• Security Assurance, whose Security Engineering team deploys and maintains the sensors and platforms this team monitors, whose Vulnerability Management team coordinates the response to critical vulnerabilities and zero-days, and whose Offensive Security team validates detections through purple team exercises.
• Security Architecture, which sets the logging, monitoring, and data protection architecture that detection coverage is built on.

We value diverse experiences, perspectives, and career paths, and welcome candidates who are excited to contribute to our mission.

Responsibilities:

Detection and Monitoring — SIEM, MDR and Telemetry Coverage

• Own SEIM end to end: design, deployment, priority log onboarding, detection content, tuning, and ongoing cost management.
• Own and enforce a log coverage standard spanning cloud, SaaS, endpoint, network, application and laboratory environments, and close the gaps where coverage does not exist today.
• Manage the 24x7 MDR provider. Own the service levels, the escalation path into SiTime, the quality review cycle and the operating rhythm.
• Build detection use cases aligned to the threats that matter to a fabless semiconductor company, including unauthorized access to and bulk movement of design data and source code.
• Establish alert triage, case management and hand-off workflow between the MDR provider and SiTime Security; measure and drive down time to acknowledge and time to contain.
• Set log retention standards sufficient to support forensic investigation, legal hold and customer or regulatory inquiry.
• Partner with Security Engineering on the coverage, configuration health and alert quality of CrowdStrike, Darktrace, Microsoft Defender and future sensors.

Threat Hunting, Intelligence and Detection Improvement

• Run a threat hunting program, directly and through the MDR provider, focused on the adversary tradecraft used against semiconductor, hardware and intellectual property targets.
• Track threat intelligence relevant to SiTime, including state-linked activity, and turn it into detection content and hunting hypotheses.
• Map detection coverage to MITRE ATT&CK, and to MITRE ATLAS for AI systems and agents, and close the highest-risk gaps first.
• Participate in purple team exercises with Offensive Security, and convert every missed technique into a tested detection.
• Provide exploitation and threat signal to Vulnerability Management, and partner on the vulnerability response playbook and tabletop exercises for critical vulnerabilities and zero-days.
• Produce detection and response metrics that demonstrate risk reduction rather than alert volume.