Director, Cybersecurity Operations

onsemi•Scottsdale, AZ

3h•Hybrid

About The Position

The Director, Security Operations is a senior leadership role within the Office of the CISO, accountable for the strategy, design, and 24x7x365 execution of onsemi’s global security operations across both IT and OT domains. This leader owns the Security Operations Center (SOC), threat detection and response, threat intelligence, vulnerability management, and the operational technology security program protecting global enterprise and manufacturing environments. The Director will modernize detection and response through automation, agentic AI-enabled SecOps, and a measurable, risk-driven operating model. They will be a hands-on leader who balances strategic program ownership with operational rigor, manages managed security service provider (MSSP) relationships, and serves as a primary incident commander during high-severity events.

Requirements

12+ years of progressive cybersecurity experience, with 5+ years leading security operations, SOC, or incident response functions.
Demonstrated experience building and leading distributed 24x7 SOC teams, including MSSP/MDR governance and hybrid operating models.
Deep expertise in threat detection and response, SIEM/SOAR, EDR/XDR, threat intelligence, and modern detection engineering.
Proven incident command experience leading high-severity, business-impacting incidents end to end.
Strong people leadership: building, scaling, and retaining technical security teams.
Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience.

Nice To Haves

Experience securing converged IT/OT environments, ideally in semiconductor, manufacturing, or other critical-infrastructure industries.
Familiarity with export-control (ITAR/EAR) data residency requirements and Fortune 500 regulatory environments (SOX, GDPR).
Hands-on experience deploying automation and agentic AI SecOps platforms in production.
Industry certifications such as CISSP, CCSP, GCIA, GCIH, or equivalent.
Knowledge of ISO27001, NIST CSF 2.0, MITRE ATT&CK, and ICS/OT security frameworks (e.g., IEC 62443).

Responsibilities

Define and execute the global security operations strategy and roadmap across converged IT and OT environments, aligned to onsemi’s business and manufacturing priorities.
Build, lead, and develop a high-performing global SOC team and pod-based operating model spanning detection engineering, incident response, threat intelligence, and OT security.
Establish and report security operations metrics, KPIs, and maturity (e.g., MTTD/MTTR, coverage, detection efficacy) to the CISO and executive leadership.
Own the MSSP and managed detection and response (MDR) relationships, including contract strategy, performance governance, and the build-versus-buy roadmap for SOC capabilities.
Direct 24x7x365 monitoring, triage, investigation, and response across endpoint, network, cloud, identity, AI runtime, and OT telemetry.
Serve as senior incident commander for P1/P2 incidents, coordinating cross-functional response, executive communication, and post-incident review.
Mature the detection engineering function, threat hunting, and purple-team practices to continuously improve coverage against MITRE ATT&CK and ICS/OT threat models.
Lead the vulnerability management and threat intelligence programs, prioritizing remediation based on exploitability and business risk.
Extend security operations visibility and response into manufacturing OT environments, partnering with manufacturing and engineering teams to protect production continuity.
Champion IT/OT convergence with security models that respect the availability, safety, and uptime requirements of industrial control systems.
Drive adoption of automation, SOAR, and agentic AI SecOps platforms to scale detection and response while improving analyst efficiency and reducing alert fatigue.
Anticipate and defend against frontier AI-enabled threats, embedding AI-aware detection and response into the operating model.
Ensure security operations support onsemi’s regulatory and customer obligations, including export-control (ITAR/EAR) data handling, SOX, GDPR, and customer/industry security requirements.
Partner with IT, Trust & Assurance, legal, privacy, and business stakeholders to align operational response with enterprise risk and incident response obligations.
Manage the security operations budget, vendor portfolio, and tooling rationalization to deliver measurable risk reduction and cost efficiency.