Lead, Security Operations

Genworth Financial • Richmond, VA

10d • Hybrid

About The Position

As Lead, Security Operations at Genworth | CareScout, this role leads the Computer Security Incident Response Team (CSIRT) and coordinates cybersecurity incident response across the enterprise. It guides preparation and response activities—from planning, intelligence, and detection engineering through investigation, containment, recovery, and lessons learned—to protect information, minimize business disruption, and strengthen operational resilience. The role combines technical leadership with hands-on operational accountability, including developing team capabilities, strengthening response plans and playbooks, and ensuring clear ownership, timely escalation, and effective communication during complex incidents.

The role partners across Technology, business functions, and external providers to turn incident insights into practical improvements and keep response capabilities aligned with evolving threats and business needs. The position is available to Virginia residents as hybrid in Richmond, VA, or remotely to applicants residing in North Carolina, Maryland, Virginia, or the DC Metro area. Employees residing within 50 miles of a Genworth | CareScout office are expected to work a hybrid schedule; employees outside that radius should expect approximately 25% travel. Working hours target core business hours of 9 a.m.–5 p.m. Eastern Time, with support for incident escalations outside normal business hours.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or 7+ years of equivalent relevant experience.
• Significant progressive experience in cybersecurity operations and incident response, including leadership of a CSIRT or comparable response function.
• Demonstrated experience directing complex cybersecurity incidents and coordinating response across technical teams, business stakeholders, and external partners.
• Strong technical knowledge of incident investigation, containment, eradication, and recovery across endpoint, network, identity, and cloud environments.
• Experience with security monitoring and investigation technologies, including SIEM, EDR, and security orchestration and automation tools.
• Working knowledge of digital forensics, evidence handling, threat intelligence, and attacker tactics, techniques, and procedures.
• Experience developing incident response plans, playbooks, escalation frameworks, readiness exercises, and performance measures.
• Ability to lead and develop technical professionals, establish operational discipline, and maintain clear accountability during high-pressure situations.
• Strong judgment and communication skills, including the ability to explain technical issues, business impacts, and response decisions to senior leaders and nontechnical audiences.
• Experience in a regulated environment, preferably financial services or insurance, including partnership with Legal, Privacy, Risk, and Compliance on incident-related requirements.
• Ability to support incident escalations outside normal business hours.

Nice To Haves

• Relevant certifications such as CISSP, GCIH, GCFA, or comparable incident response credentials.

Responsibilities

• Lead the Computer Security Incident Response Team (CSIRT), set priorities, develop team capabilities, and establish accountability for incident readiness and response.
• Direct cybersecurity incident response from initial triage and investigation through containment, eradication, recovery, and post-incident review.
• Coordinate incident response across Cybersecurity, Technology, business teams, and external partners, ensuring clear ownership, timely escalation, and effective handoffs.
• Maintain and enhance incident response plans, playbooks, severity criteria, and escalation procedures.
• Serve as a primary escalation point for significant cybersecurity incidents and communicate technical findings, business impacts, response options, and updates to leadership.
• Partner with Legal, Privacy, Compliance, Risk, Communications, and Business Continuity teams on incident decisions, notification assessments, and recovery coordination.
• Guide investigations, including evidence preservation, forensic analysis, and documentation, engaging internal specialists and external providers as needed.
• Lead tabletop exercises and response simulations to test readiness, clarify responsibilities, and address gaps.
• Use incident trends, threat intelligence, and lessons learned to strengthen detection and response capabilities, improve playbooks, and reduce recurring issues.
• Establish response metrics and reporting, oversee incident response service providers, and improve response speed, quality, and operational resilience.
• Leverage AI and automation to identify and respond to cybersecurity threats at machine speed.

Benefits

• Bonus incentive plan; incentive compensation is based on individual and company performance and is not guaranteed.
• Comprehensive healthcare coverage.
• Multiple 401(k) savings plan options.
• Auto enrollment in an employer-directed retirement account feature that is 100% employer-funded.
• Generous paid time off, including 12 paid holidays, volunteer time off, and paid family leave.
• Disability, life, and long-term care insurance.
• Tuition reimbursement, student loan repayment, and training and certification support.
• Wellness support, including gym membership reimbursement and Employee Assistance Program resources for work/life support and financial and legal management.
• Caregiver and mental health support services.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior