Director Cybersecurity Operations

Generac Power Systems•Waukesha, WI

7d•Onsite

About The Position

Generac is seeking a Director of Cybersecurity Operations to lead and evolve our global security operations and cybersecurity engineering functions, safeguarding a growing technology-driven enterprise. This high-impact leadership role is responsible for shaping and executing Generac's cybersecurity operations strategy while building a world-class security program capable of detecting, responding to, and mitigating emerging threats across our global environment. You will provide strategic oversight of enterprise incident response capabilities, partner closely with managed security and XDR providers, and drive the modernization of security operations through advanced automation, SOAR technologies, and AI-driven security solutions. In addition, you will lead global Cybersecurity Engineering teams responsible for the design, optimization, and management of Generac's enterprise security technology ecosystem. This includes enhancing security telemetry, advancing SIEM capabilities, and ensuring our security infrastructure remains adaptive, resilient, and ahead of an evolving threat landscape. The ideal candidate combines deep technical expertise in security operations and cyber defense with exceptional leadership capabilities, bringing a proven track record of developing high-performing teams, driving cybersecurity transformation, and influencing executive stakeholders. This role offers the opportunity to make a lasting impact on the security posture of a global organization while helping shape the future of cybersecurity at Generac.

Requirements

10 years of progressive experience in cybersecurity, with at least 5 years leading security operations, incident response, or security engineering functions.
Demonstrated leadership of global teams spanning engineering and operations disciplines.
Experience directing enterprise incident response, including major incident command and coordination with external incident response partners, legal counsel, and executive leadership
Experience managing XDR, MSSP, or managed detection and response service providers, including contract, service level, and performance management.
Experience implementing or operating SOAR platforms and SIEM technologies at enterprise scale, including telemetry onboarding, detection engineering, and automation.
Experience with industry security best practices and frameworks, including but not limited to NIST CSF, MITRE ATT&CK, and ISO 27001.
Excellent communication and collaboration skills, with the ability to brief executives during high pressure incidents and translate technical detail into business terms.
Strong understanding of modern security operations, including detection engineering, automation, and the application of AI to security operations workflows.
Strong analytical and problem solving skills, with the ability to make sound decisions quickly under pressure.

Nice To Haves

CISSP, CISM, or GIAC certifications such as GCIH or GCED, or equivalent
Leadership of a large scale security operations center or managed detection and response function.

Responsibilities

Provide strategic and operational leadership of the global security operations center, establishing the vision, operating model, and maturity roadmap for a world class detection and response capability.
Establish and monitor performance objectives for the operations function, including detection coverage, alert quality, and response time targets, with continuous improvement against measurable outcomes.
Own strategic direction of the enterprise Incident Response function, including playbooks, escalation paths, tabletop and technical exercises, and executive communications.
Partner with XDR service providers and managed security services to deliver around the clock detection and response coverage, ensuring clear roles, service levels, and accountability across internal and external teams.
Lead major incident response engagements, coordinating internal, managed service, and external partner resources through containment, eradication, recovery, and lessons learned.
Mature the operations function by establishing SOAR capabilities that automate triage, enrichment, and response actions to reduce mean time to detect and mean time to respond.
Leverage AI capabilities to augment analyst workflows, improve signal quality, and scale the operations team to meet the demands of the modern threat landscape.
Lead the Cybersecurity Engineering teams responsible for managing enterprise security technology capabilities, including endpoint, network, cloud, identity, and email security platforms.
Drive engineering standards for deployment, configuration, lifecycle management, and health monitoring of security technologies across a global environment.
Own the strategy for integrating and rightsizing telemetry into the SIEM, ensuring the right sources, parsing, enrichment, and retention to support timely reporting and automation.
Continuously evaluate telemetry value against cost, tuning ingestion and detection content to keep pace with, or ahead of, threats as they emerge.
Establish detection engineering practices that translate threat intelligence into high quality detections mapped to industry frameworks such as MITRE ATT&CK.
Operationalize threat intelligence to prioritize detection coverage, threat hunting, and response readiness for the threats most relevant to the business.
Govern the performance of XDR, managed detection and response, and incident response retainer partners through defined service levels, quality reviews, and continuous improvement plans.
Right size the balance of internal and external capabilities to optimize cost, coverage, and institutional knowledge.
Build, lead, and develop high performing global engineering and operations teams, including hiring, mentoring, performance management, and succession planning.
Establish a sustainable surge and after hours response model that is well practiced and supported by clear procedures, training, and tooling.
Define and report key operational metrics for executive and board level audiences, tying operational performance to measurable risk reduction.
Drive post incident reviews and continuous improvement across people, process, and technology.
Partner with enterprise cybersecurity functions, including governance risk and compliance, product security, and regional security leaders, to align operations with enterprise strategy and compliance obligations.
Support audit, regulatory, and customer assurance activities with timely evidence and operational expertise.