Director, Cybersecurity Operations Center

Delek US • Brentwood, TN

9d

About The Position

Leads Security Operations with primary responsibility for running the Security Operations Center (SOC), directing 24x7x365 monitoring, detection, triage, investigation, escalation, and response activities across Information Technology (IT), Operational Technology (OT), cloud, identity, network, endpoint, and third-party environments. Serves as a decisive incident commander during cyber security events by rapidly assessing severity, establishing priorities, assigning ownership, coordinating cross-functional response teams, briefing executive leadership, and driving incidents through containment, eradication, recovery, and post-incident improvement. Ensures that cyber security monitoring, detection, response, incident management, threat intelligence, threat hunting, and SOC processes are aligned with IS standards, cyber security standards, and overall cyber risk management objectives. Identifies cyber threats, suspicious activity, security incidents, and operational exposures; determines the scope, severity, and business impact of cyber events; and coordinates procedures to contain incidents, restore normal operations, and improve future detection and response capabilities. Develops techniques and procedures for conducting cyber security monitoring, alert triage, incident investigation, threat analysis, threat hunting, digital evidence collection, cyber readiness exercises, and post-incident reviews. Leads investigation and resolution of cyber security incidents such as intrusions, malware activity, unauthorized access, fraud, attacks, data loss events, or leaks.

Requirements

• 4 year / Bachelor's Degree (Required)
• Four (4) or more years management experience (Required)
• Four (4) or more years experience leading a SOC, MDR function, incident response team, or cyber defense analysts with direct accountability for monitoring, detection, escalation, incident command, and response execution (Required)
• Ten (10) or more years experience of relevant related field of Security Operations, Monitoring & Detection, Incident Response, Threat Intelligence, Threat Hunting, Digital Forensics, or Cyber Defense (Required)
• Proven experience serving as incident commander for complex cyber incidents across IT and OT, including executive coordination, business impact assessment, response decision-making, regulatory reporting, and post-incident corrective action
• Skilled in using SIEM, SOAR, EDR/XDR, NDR, forensic, threat intelligence, and security monitoring tools, with a strong grasp of frameworks like NIST, MITRE ATT&CK, and ISA/IEC-62443
• Strong organizational skills and ability to set priorities and handle multiple projects concurrently
• Knowledge of cyber threat and/or intelligence analysis
• Knowledge of cyber incident response, threat hunting, detection engineering, malware investigation, and digital forensics practices
• Solid understanding of cyber security and ability to analyze incident reporting, investigation results, response actions, and follow-up with reporting sites
• Strong knowledge of incident management, problem management and change management best practices

Nice To Haves

• Cyber security related certifications such as CISSP, GSEC, etc

Responsibilities

• Serve as a decisive incident commander during cyber security events by rapidly assessing severity, establishing priorities, assigning ownership, coordinating cross-functional response teams, briefing executive leadership, and driving incidents through containment, eradication, recovery, and post-incident improvement.
• Ensure that cyber security monitoring, detection, response, incident management, threat intelligence, threat hunting, and SOC processes are aligned with IS standards, cyber security standards, and overall cyber risk management objectives.
• Identify cyber threats, suspicious activity, security incidents, and operational exposures; determine the scope, severity, and business impact of cyber events; and coordinate procedures to contain incidents, restore normal operations, and improve future detection and response capabilities.
• Develop techniques and procedures for conducting cyber security monitoring, alert triage, incident investigation, threat analysis, threat hunting, digital evidence collection, cyber readiness exercises, and post-incident reviews.
• Lead investigation and resolution of cyber security incidents such as intrusions, malware activity, unauthorized access, fraud, attacks, data loss events, or leaks.
• Lead operational engagements with internal teams, managed security providers, incident response partners, and technology vendors to support security monitoring, threat detection, and cyber response services.
• Partner with PMO team to oversee portfolio of cyber security operational services and pipeline of projects/tasks to create, evolve, and improve monitoring, detection, and response capabilities.
• Responsible for developing, maintaining, and continuously improving the Security Operations operating model, including SOC coverage, alert intake, triage, escalation, investigation, response coordination, performance measures, and integration.
• Ensure monitoring services are being fulfilled 24x7x365.
• Provide direct leadership, oversight, direction, scheduling, quality control, and performance management for SOC activities, analysts, service providers, and escalation processes.
• Establish and enforce incident command structure, escalation criteria, communication cadence, decision logs, action tracking, and after-action review practices for cyber security events.
• Perform review and validation of all deliverables for SOC, Incident Response, Threat Intelligence, Threat Hunting, Detection Engineering, and other assigned activities.
• Develop policies, instructions, standards, and procedures around security operations functions.
• Provide Metrics and Artifacts supporting audit activities.
• Brief executives about current cyber threats, incidents, operational readiness, and pertinent information.
• Ensure timely and accurate reporting to all relevant stakeholders (Internal & External).
• Responsible for overall use of resources and initiation of corrective action where required for Security Operations Center activities.
• Perform threat management, identify threat vectors, monitor relevant threat actors, and develop use cases for security monitoring.
• Develop, tune, validate, and maintain security monitoring use cases, detection content, alert logic, response workflows, and escalation procedures.
• Lead threat hunting activities to identify indicators of compromise, anomalous activity, and previously undetected threats.
• Translate cyber threat intelligence into actionable monitoring, detection, hunting, and response procedures.
• Coordinate with Cybersecurity Architecture, Infrastructure, Applications, Governance, Risk & Compliance, and business teams to ensure effective operational response to identified threats, vulnerabilities, and incidents.
• Conduct cyber readiness exercises, tabletop exercises, and incident response simulations to validate operational preparedness.

Benefits

• Up to a 10% match on 401K on your hire start, with a vesting timeline of only one year
• Medical benefits that start on day one with a 30% premium rebate annually
• Access to the Calm app for FREE
• Additional annual incentives through performance management program
• Pay for performance culture

What This Job Offers

• Job Type: Full-time
• Career Level: Director