Executive Director - Cyber Defense Operations

CVS Health•Hartford, CT

3d•$175,100 - $334,750

About The Position

The Executive Director of Cyber Defense Operations is a senior cybersecurity leader accountable for defining and executing the enterprise-wide strategy, operating model, and capabilities for cyber detection, response, and incident management. The role provides strategic and operational oversight of the Security Operations Center (SOC) and Computer Security Incident Response Team (CSIRT), enabling the organization to identify, contain, and remediate cyber threats rapidly while continually improving cyber defense capabilities. The Executive Director leads during significant cyber events, sets priorities, mobilizes business and technology teams, and translates evolving threats into business, operational, and regulatory implications. The role establishes the long-term vision for cyber defense operations and integrates threat intelligence, threat hunting, advanced analytics, automation, and orchestration to strengthen detection and response at enterprise scale. It also advances the strategic use of AI, automation, and emerging autonomous capabilities. As a senior leader within Cyber Defense, this position builds partnerships across business, technology, legal, compliance, and security functions to align cyber defense capabilities and investments with business priorities, regulatory requirements, and the threat landscape. The Executive Director develops high-performing global teams and senior cybersecurity leaders, and provides executive-level insights, metrics, and strategic guidance to support informed decisions and organizational resilience.

Requirements

15+ years of experience in a technical cybersecurity function.
8+ years in a leadership role managing global detection and response, threat hunting, or security operations teams.
5+ years of experience developing and executing a long-term strategic vision for security operations at enterprise scale.
5+ years of experience leveraging automation and orchestration, such as SOAR, to improve the efficiency and effectiveness of a SOC.
2+ years of experience applying AI and machine learning to security data for anomaly detection, threat modeling, and predictive security.
Bachelor’s degree or equivalent experience; alternatively, a high school diploma and 4 years of relevant experience.

Nice To Haves

Experience managing a globally distributed 24/7 security operations team.
Experience defining and driving a multiyear strategy for threat detection and response.
Strong understanding of security frameworks, risk management, and incident response.
Deep understanding of the people, processes, and technologies involved in a successful cybersecurity program.
Strong leadership and people management skills.
Strong project management and time management skills.
Proficiency in analyzing operational data and creating visualizations and reports.
Strong verbal and written communication and presentation skills.
Relevant industry certifications such as GAIC and CSIRT.

Responsibilities

Develop, maintain, and execute the enterprise-wide detection and response program in alignment with Cyber Defense, business objectives, and regulatory requirements.
Own and maintain the enterprise Detection and Response Maturity Model, strategy, roadmap, and operating model.
Lead and mentor triage, detection engineering, threat hunting, and incident response professionals, fostering continuous improvement and operational excellence.
Partner with senior leaders across Product, Engineering, and Security, and advocate for the telemetry and architectural changes needed to support future detection use cases.
Serve as Incident Commander for major security incidents, coordinating technical teams and executive leadership.
Develop detection content aligned with ATT&CK, ATLAS, D3FEND, and other cybersecurity frameworks.
Identify and communicate root-cause patterns to leadership, anticipate future challenges, and deliver solutions before they become bottlenecks.
Track OKRs aligned to maturity models and define, track, and report KPIs and KRIs for operational and strategic improvements.
Partner with threat intelligence and other security teams to enhance detection and response capabilities.
Act as a liaison with legal, compliance, and public relations during high-impact incidents.
Provide executive-level briefings and actionable insights to senior leadership.
Drive automation and orchestration initiatives to improve operational efficiency.
Monitor emerging threats and adapt operations, tactics, and strategies accordingly.
Lead tabletop exercises and other simulations to validate readiness.