Director Security Operations

Sierra Nevada Corporation•Sparks, NV

About The Position

The Director of Security Operations provides strategic leadership and oversight for the organization’s comprehensive security program, including information security, industrial security, special programs management, crisis management, investigations, and security operations center (SOC) functions. The role ensures that security policies, standards, and procedures are implemented across domestic and international operations and partners with business units to align security solutions with organizational goals and emerging threats. The director oversees 24x7x365, multi-tier SOC operations; leads critical-incident response; establishes operational procedures and performance standards; and advances threat hunting and active defense. The role also leads cloud security engineering and the modernization of detection and response capabilities, including the use of machine learning, predictive threat analytics, and AI agents. It oversees SIEM, SOAR, EDR/XDR, and cloud-native security platforms. The director serves as a senior operational liaison to clients, enterprise leadership, and regulatory bodies; leads client briefings during major incidents; and oversees cyber threat intelligence, operational reporting, executive dashboards, and threat advisories. The position advises executives, conducts risk and compliance assessments, and develops security policies, strategies, and mitigation plans. Work is in an office or hybrid environment, with travel as needed.

Requirements

Bachelor’s degree in a related field; a higher-level relevant degree may substitute for experience.
At least 13 years of experience in a related role, including at least 6 years in a leadership role such as Director, Senior Manager, or equivalent; a higher-level relevant degree may substitute for experience.
At least 7 years of progressive cybersecurity experience.
Verifiable experience leading operations in an MSSP, government or defense intelligence agency SOC, or Fortune 500 enterprise SOC.
Proven record leading incident response and crisis management in high-stress, mission-critical situations under strict time constraints.
Hands-on familiarity managing engineering initiatives involving cloud security architectures, automation/SOAR pipelines, and ML/AI-driven detection tooling.
Exceptional written and verbal communication skills, including the ability to present technical threat analyses to executive committees and enterprise clients.
Strong knowledge of information security, industrial security, and regulatory compliance.
Ability to develop and implement policy, influence partners to incorporate security requirements into functional-area operations, and drive process improvement.
Ability to interpret the intent of guidelines and regulations and use considerable judgment in applying them to individual situations.
Strong decision-making skills, including the ability to communicate the bottom line up front, simplify complex information, and make timely, well-reasoned decisions.
Ability to obtain and maintain a Secret U.S. Security Clearance; U.S. citizenship is required because the position needs an active U.S. Security Clearance for employment.
Ability to lift up to 25 pounds occasionally.
Ability to sit for extended periods and work on a computer.

Nice To Haves

Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience.
CISSP, CISM, or CCISO certification.
Advanced technical certifications such as GIAC GCIH, GCFA, GNFA, or GCDA.
Deep understanding of threat actor tactics, techniques, and procedures, malware analysis lifecycles, and forensic methodologies.
Practical exposure to LLMs, generative AI tools, or agentic frameworks used in security workflows, such as automated alert triage or natural-language threat hunting.
Mastery of modern detection and telemetry stacks such as Splunk, Microsoft Sentinel, CrowdStrike Falcon, Palo Alto Cortex XSOAR, or Datadog.

Responsibilities

Oversee 24x7x365 multi-tier SOC operations, including operational cadence, shift handovers, escalation paths, and service level agreements and objectives.
Direct responses to critical incidents and serve as the senior escalation point and incident commander during active threats, breaches, and outages.
Establish standard operating procedures, playbooks, and runbooks aligned with industry frameworks, including MITRE ATT&CK, MITRE ATLAS, NIST CSF, and ISO 27001.
Maintain analyst performance and operational rigor while mitigating alert fatigue and burnout.
Advance proactive threat hunting and active defense initiatives.
Manage SOC financial planning, analysis, and reporting.
Lead the security engineering team responsible for building, deploying, and maintaining cloud-native detection, response, and monitoring pipelines across AWS, Azure, and GCP.
Promote the use of machine learning models, predictive threat analytics, and autonomous AI agents for automated triage, alert enrichment, and remediation.
Oversee SIEM, SOAR, EDR/XDR, and cloud-native security platforms, refining detection engineering, rule tuning, and pipeline efficiency.
Serve as the senior operational liaison for key client stakeholders, enterprise leadership, and regulatory bodies.
Lead client briefings during major incidents, presenting root-cause analyses, containment actions, and remediation paths.
Partner with Product, Customer Success, and Sales Engineering teams to align SOC capabilities with client expectations and service offerings.
Oversee actionable cyber threat intelligence and operational reporting.
Author and review cyber activity reports, executive dashboards, and threat advisories for technical teams and executive and external customer leadership.
Lead the strategic planning and execution of the security program.
Develop and implement security policies and strategy.
Advise executive leadership on security-related matters.
Conduct risk and compliance assessments and develop mitigation strategies.
Influence partners to incorporate security requirements into functional-area operations and drive process improvement within and outside the security organization.