Director, Proactive Defense Operations

GSK

9d • $168,750 - $281,250

About The Position

The Director, Proactive Defense Operations owns the Proactive Defense Operations (PDO) capability end to end, including its strategy, roadmap, delivery, service performance, and team. The role translates global adversary threat data into validated, automated defensive action at machine speed and leads the Predictive Security Operations team in anticipating and responding to evolving cyber threats.

PDO shifts from an intelligence-and-reporting model to an automation- and engineering-centric capability. It converts global threat data into operational actions by interrogating internal telemetry, triggering automated defenses, and providing defenders with contextualized, high-fidelity blueprints. The capability has two operational pillars: Intelligence Automation and Threat & Context Analysis. It works closely with Detection Engineering, SecOps/Incident Response, and Vulnerability Management as the proactive defensive engine of Cyber Defense.

The Director leads and develops the team, manages the capability budget and supplier relationships, reports performance and risk to CSO leadership and governance forums, and establishes the frameworks, service levels, technology governance, and metrics needed to ensure threat intelligence is translated into rapid defensive outcomes. The role also promotes responsible use of approved AI tools in line with GSK’s Responsible AI, privacy, and security requirements.

Requirements

• Bachelor’s degree in cybersecurity, computer science, information technology, or a related discipline, or equivalent related experience.
• 12+ years of cybersecurity experience.
• Experience in security operations, detection engineering, or security data science.
• Experience with SIEM/SOAR platforms, telemetry pipelines, and detection rule frameworks such as YARA-L or Sigma.
• Experience owning a cybersecurity capability end to end.
• Leadership or people management experience with technical or specialist teams.
• Experience managing budgets, suppliers, and delivery commitments.

Nice To Haves

• CISSP, CISM, or equivalent senior security certification.
• Expert-level proficiency in MITRE ATT&CK and Cyber Kill Chain operationalization.
• Experience engineering or governing low-code/no-code automation at enterprise scale.
• Experience leading teams that operationalize intelligence into automated defensive action.
• Familiarity with AI/ML integration in security workflows, particularly generative AI for detection logic drafting and NLP-driven telemetry querying.
• Track record of breaking down silos between intelligence, detection, and response functions, with exposure to OT/ICS threat environments.
• Experience in pharmaceutical, life sciences, or another highly regulated industry.
• Experience working with GxP-regulated data and technology environments.
• Experience working across scientific, manufacturing, data, engineering, Quality, and technology teams.
• Experience providing technical leadership, coaching specialists, or establishing standards and reusable technical patterns.
• Ability to translate complex scientific, manufacturing, and technical concepts for different stakeholder groups.

Responsibilities

• Own the Proactive Defense Operations capability end to end, including its roadmap, delivery, and service performance.
• Lead and develop the team, setting priorities and managing performance across both operational pillars.
• Own the capability budget and supplier and vendor relationships.
• Report capability performance and risk to CSO leadership and governance forums.
• Own the enterprise Priority Intelligence Requirements (PIR) framework, calibrating threat collection and automated triage to actual corporate risk.
• Direct machine-speed exposure triage and escalation, setting SLAs from threat identification to validated Incident Response escalation or Proactive Operational Pack (POP) delivery.
• Govern the PDO technology stack, including SIEM, security data lake, SOAR, and Threat Intelligence Platform, and approve automation pipeline and API integration architecture.
• Own the RASCI interfaces with Detection Engineering, SecOps/Incident Response, and Vulnerability Management, ensuring PDO outputs are consumed rapidly and without rework.
• Build and maintain metrics that show whether the Cyber Defense function is getting ahead of threat activity.
• Lead the team in using approved AI tools to improve productivity and ways of working, role-modeling responsible use and following GSK’s Responsible AI, privacy, and security requirements.

Benefits

• Annual bonus.
• Eligibility to participate in a share-based long-term incentive program, dependent on the level of the role.
• Health care and other insurance benefits for employees and family.
• Retirement benefits.
• Paid holidays.
• Vacation.
• Paid caregiver, parental, and medical leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Director