Director, Enterprise Secruity

Virta Health

34d•$161,500 - $209,000•Remote

About The Position

Virta Health is hiring a Director of Enterprise Security to build and shape its security operations function. This is a player-coach role: the Director will initially work hands-on in investigations, detection, and tooling while establishing the standards, structure, and direction for the growing function. The role combines technical leadership and incident response to keep systems resilient, support frictionless end-user workflows, and protect patient data. The Director will lead and develop a security operations team, determine its operating model and roadmap, own detection engineering and security platforms, and manage incidents from triage through post-incident review. The position also covers hands-on investigations, automated response, defense validation, vendor security expectations, AI-assisted security capabilities, and collaboration with GRC to automate compliance evidence collection. The first 90 days include assessing current capabilities, developing a six-month roadmap, and beginning delivery while establishing a maturity dashboard and measurable goals.

Requirements

10+ years of experience in security operations, detection and response, or cloud security, including 3+ years leading or mentoring technical security teams.
Hands-on incident response experience across logs, endpoints, identity, cloud, and SaaS, including leading incidents from triage through post-incident review.
Experience writing and maintaining detection rules, ideally using a detection-as-code model, and a solid understanding of coverage frameworks such as MITRE ATT&CK.
Strong scripting or programming skills, such as Python or Go, and a track record of building internal tools, integrations, or automation that improved security team efficiency.
Deep experience owning and tuning security platforms such as SIEM, EDR/XDR, CSPM, and SOAR, including onboarding new data sources.
Hands-on cloud security experience, ideally with GCP and containerized workloads.
Practical experience applying AI to security or operational work beyond basic prompting, such as building AI-assisted workflows, tools, or agents that measurably reduce manual effort.
Clear communication skills, including the ability to explain technical risk and security strategy to executives, engineering teams, and vendors.

Nice To Haves

Experience with GCP and containerized workloads.
Experience with detection-as-code.

Responsibilities

Direct, mentor, and grow a high-performing security operations team; lead technical sprint planning, alignment, and coaching while remaining able to work hands-on with configurations.
Build the enterprise security function, including its structure, hiring plan, long-term roadmap, sourcing strategy, and security budget priorities.
Define the SOC operating model, including coverage, on-call arrangements, escalation paths, and effectiveness metrics.
Design and tune detections as code, with version control and testing, across security platforms.
Lead technical incident response from triage through post-incident review, coordinating across teams and driving resolution.
Conduct hands-on investigations involving log analysis, triage, identity, cloud, SaaS, and endpoint concerns.
Build and evolve automated response capabilities using threat models and SOAR orchestration to contain threats and minimize their blast radius.
Own and tune security visibility platforms, including CASB, CSPM, and CNAPP solutions.
Run recurring testing and informed adversary emulation to validate security posture and detection and mitigation effectiveness.
Establish security expectations for enterprise systems and lead vendor evaluations, including BAA requirements and HITRUST/SOC 2 assurance expectations.
Develop AI-assisted security operations capabilities that provide context, tools, and guidance for connecting disparate data.
Partner with GRC to automate evidence collection and generation across security platforms and map evidence to relevant controls.
During the first 30 days, learn Virta’s cloud systems and security platforms, build collaborative relationships with engineering, IT, and GRC, and assess security operations capabilities.
By days 30–60, develop a six-month roadmap based on the assessment, including improvements to standards, processes, and integration of security platforms into a more unified detection and response workflow.
By days 60–90, begin delivering roadmap improvements, reduce manual work, strengthen detection and response, create a security operations maturity dashboard, present it to executive leadership, and establish measurable goals for the next six months.