Executive Director - Cyber Defense Operations

CVS Health•Hartford, CT

1d•$175,100 - $334,750

About The Position

The Executive Director of Cyber Defense Operations is a senior cybersecurity leader accountable for defining and executing the enterprise-wide strategy, operating model, and capabilities for cyber detection, response, and incident management. The role provides strategic and operational oversight of the Security Operations Center (SOC) and Computer Security Incident Response Team (CSIRT), positioning the organization to identify, contain, and remediate cyber threats while continuously improving cyber defense maturity and effectiveness. The Executive Director establishes the long-term vision for cyber defense operations and integrates threat intelligence, threat hunting, advanced analytics, automation, and orchestration to strengthen enterprise-scale detection and response. During significant cyber events, this leader sets priorities and mobilizes business and technology organizations while translating evolving threats into business, operational, and regulatory implications. The role builds partnerships with business, technology, legal, compliance, and security leaders to align cyber defense capabilities and investments with business priorities, regulatory requirements, and the threat landscape. It advances the strategic use of AI, automation, and emerging autonomous capabilities, develops high-performing global teams and senior cybersecurity leaders, and delivers executive-level insights, metrics, and guidance to support decision-making and organizational resilience.

Requirements

15+ years of experience in a technical cybersecurity function.
8+ years in a leadership role managing global detection and response, threat hunting, or security operations teams.
5+ years of experience developing and executing a long-term strategic vision for enterprise-scale security operations.
5+ years of experience leveraging automation and orchestration, such as SOAR, to improve SOC efficiency and effectiveness.
2+ years of experience applying AI and machine learning to security data for anomaly detection, threat modeling, and predictive security.
Bachelor’s degree or equivalent experience; alternatively, a high school diploma and 4 years of relevant experience.

Nice To Haves

Experience managing a globally distributed 24/7 security operations team.
Experience defining and driving a multiyear strategy for threat detection and response.
Strong understanding of security frameworks, risk management, and incident response.
Deep understanding of the people, processes, and technologies involved in a successful cybersecurity program.
Strong leadership and people management skills.
Strong project management and time management skills.
Proficiency in analyzing operational data and creating visualizations and reports.
Strong verbal and written communication and presentation skills.
Relevant industry certifications such as GAIC and CSIRT.

Responsibilities

Develop, maintain, and execute the enterprise-wide detection and response program in alignment with Cyber Defense, business objectives, and regulatory requirements.
Own and maintain the enterprise Detection and Response Maturity Model, strategy, roadmap, and operating model.
Lead and mentor triage, detection engineering, threat hunting, and incident response professionals, fostering continuous improvement and operational excellence.
Partner with senior Product, Engineering, and Security leaders, advocating for telemetry and architectural changes needed to support future detection use cases.
Serve as Incident Commander for major security incidents, coordinating technical teams and executive leadership.
Develop detection content aligned with ATT&CK, ATLAS, D3FEND, and other cybersecurity frameworks.
Identify and communicate root-cause patterns, anticipate future challenges, and deliver solutions before they become bottlenecks.
Track OKRs aligned to maturity models and define, track, and report KPIs and KRIs for operational and strategic improvements.
Partner with threat intelligence and other security teams to enhance detection and response capabilities.
Liaise with legal, compliance, and public relations during high-impact incidents.
Provide executive-level briefings and actionable insights to senior leadership.
Drive automation and orchestration initiatives to improve operational efficiency.
Monitor emerging threats and adapt operations, tactics, and strategies accordingly.
Lead tabletop exercises and other simulations to validate readiness.
Develop high-performing global teams and senior cybersecurity leaders.
Advance the strategic use of AI, automation, and emerging autonomous capabilities in Cyber Defense.