Software Development Manager

Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely. We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.
Summary:The RoleClio is building an agentic Security Operations Center. Instead of staffing a room of analysts to watch dashboards, we're building the AI-driven system that does the watching: it triages alerts, investigates, and takes the first response action, so the humans on the team spend their time on the work that needs a human. Our goal is to automate every event we can, and we mean every event.
We're looking for the manager who builds both the Blue Team's software and the team itself. This is an engineering leadership role first. The team writes software: detection pipelines, automated response, the agents, and the integrations that tie them into Clio's products and infrastructure. You'll lead that team, set its technical direction, and stay close enough to the code to review it and contribute. Beyond leading, you'll get into the codebase and make changes in the agentic SOC and Clio's core applications, accelerated by Claude and Codex.
You won't be working alone. Clio's Red Team finds and exploits weaknesses; the Threat Intelligence function tracks who is targeting us and how. The Blue Team takes what both of them learn and turns it into defenses that hold: hardened infrastructure, hardened product, and detection that catches the next attempt automatically.
Building the TeamAs you onboard, one of the first tasks will be building out the team. We care much more about finding the right people than filling seats quickly, and you'll own that search: defining what great looks like, interviewing, and selling the work to people who have plenty of options.
The people we want are builders who are curious about security, or security people who build. You'll set the culture for a small, senior-leaning team that ships, owns the results, and makes its work visible to the rest of the company.
A Day in the LifeAI-assisted code writing in core Clio applications to add observability to the systemSitting with the Red Team after an exercise to turn their findings into detections and fixes, then confirming the fixes hold on retestReading a new threat intel brief on a technique being used against SaaS companies, and deciding which part of the infrastructure to harden firstWorking with a product engineering team to ensure incoming changes do not weaken the security posture of the applicationSpotting a spike in suspicious account activity, and asking why a human noticed it before the automation didInterviewing a candidate, then writing up honest feedback the same afternoonReviewing PRs from SOC agents, and developers from engineering teams at Clio to ensure changes are securely implementedWhat You'll DoBuild the agentic SOCLead the design and build of an AI-driven SOC that monitors, triages, investigates, and responds with as little human toil as possibleTreat every manual alert-handling step as a candidate for automation, and measure how much of the queue the system closes on its ownOwn detection engineering: detection-as-code, testing, tuningMake sure the automation is trustworthy: clear guardrails on what it can do unattended, audit trails for what it did, and a human escalation path when it isn't sureWork with the wider security team on incident response when something real happens, and feed what you learn back into the systemHarden against new adversary techniquesWork with Threat Intelligence to turn new tactics, techniques, and procedures into concrete hardening work and detection coveragePrioritize infrastructure hardening across cloud, identity, and endpoints based on observed attacker behaviour rather than benchmarks aloneHarden Clio's productsWork directly on the core security functionality of Clio's fleet of products, alongside the product engineering teams that own themPush security controls into the platform itself, so every product team gets them without having to rebuild themClose the loop with the Red TeamPartner with the Red Team to find vulnerabilities, fix them, and verify the fixesRun exercises to measure detection coverage against real attack paths, and close the gaps they exposeDetect and stop product abuseBuild automated detection for abuse of Clio's products: account takeover, fraud, scripted misuse, and patterns we haven't named yetAutomate the response as well as the detection, so confirmed abuse is contained without waiting for someone to noticeWork closely with SecDev to build preventative code generation paths, agent.md guides, and create pre-commit hooksLead the teamHire, grow, and retain a team of engineersSet clear direction and priorities, and make the team's progress visible to security leadership and the wider companyHelp define how the team scales toward follow-the-sun coverageWhat You BringStrong software develop