Executive Director - Cyber Defense Operations

CVS Health•Hartford, CT

About The Position

The Executive Director of Cyber Defense Operations is a senior cybersecurity leader accountable for defining and executing the enterprise-wide strategy, operating model, and capabilities for cyber detection, response, and incident management. The role provides strategic and operational oversight of the Security Operations Center (SOC) and Computer Security Incident Response Team (CSIRT), ensuring the organization can rapidly identify, contain, and remediate cyber threats while continually improving cyber defense maturity and effectiveness. The Executive Director establishes the long-term vision for cyber defense operations, integrating threat intelligence, threat hunting, advanced analytics, automation, and orchestration to strengthen detection and response at enterprise scale. The leader provides decisive direction during significant cyber events, setting priorities and mobilizing business and technology teams while translating evolving threats into business, operational, and regulatory implications. The role builds partnerships with business, technology, legal, compliance, and security leaders to align cyber defense capabilities and investments with business priorities, regulatory requirements, and the threat landscape. It advances the strategic use of AI, automation, and emerging autonomous capabilities, develops high-performing global teams and senior cybersecurity leaders, and delivers executive-level insights, metrics, and strategic guidance to support informed decisions and organizational resilience.

Requirements

15+ years of experience in a technical cybersecurity function.
8+ years in a leadership role managing global detection and response, threat hunting, or security operations teams.
5+ years of experience developing and executing a long-term strategic vision for enterprise-scale security operations.
5+ years of experience leveraging automation and orchestration, such as SOAR, to improve the efficiency and effectiveness of a SOC.
2+ years of experience applying AI and machine learning to security data for anomaly detection, threat modeling, and predictive security.
Bachelor’s degree or equivalent experience; alternatively, a high school diploma and 4 years of relevant experience.

Nice To Haves

Experience managing a globally distributed 24/7 security operations team.
Experience defining and driving a multiyear threat detection and response strategy.
Strong understanding of security frameworks, risk management, and incident response.
Deep understanding of the people, processes, and technologies involved in a successful cybersecurity program.
Strong leadership and people management skills.
Strong project management and time management skills.
Proficiency in analyzing operational data and creating visualizations and reports.
Strong verbal and written communication and presentation skills.
Relevant industry certifications, such as GAIC and CSIRT.

Responsibilities

Develop, maintain, and execute the enterprise-wide detection and response program in alignment with Cyber Defense, business objectives, and regulatory requirements.
Develop, own, and maintain the enterprise Detection and Response Maturity Model, strategy, roadmap, and operating model.
Lead and mentor triage, detection engineering, threat hunting, and incident response professionals, fostering continuous improvement and operational excellence.
Strategize with senior leaders across Product, Engineering, and Security, and advocate for telemetry and architectural changes needed to support future detection use cases.
Serve as Incident Commander for major security incidents, coordinating technical teams and executive leadership.
Develop detection content aligned with ATT&CK, ATLAS, D3FEND, and other cybersecurity frameworks.
Identify and surface root-cause patterns to leadership, anticipate future challenges, and deliver solutions before they become bottlenecks.
Track OKRs aligned to maturity models and define, track, and report KPIs and KRIs measuring operational and strategic improvements.
Partner with threat intelligence and other security teams to enhance detection and response capabilities.
Act as a liaison with legal, compliance, and public relations during high-impact incidents.
Provide executive-level briefings and actionable insights to senior leadership.
Drive automation and orchestration initiatives to improve operational efficiency.
Monitor emerging threats and adapt operations, tactics, and strategies accordingly.
Lead tabletop exercises and other simulations to validate readiness.