Lead, Security Operations

Genworth • Washington, DC

1d • $120,900 - $187,000 • Hybrid

About The Position

As Lead, Security Operations at Genworth | CareScout, the role leads the Computer Security Incident Response Team (CSIRT) and coordinates cybersecurity incident response across the enterprise. The Lead guides preparation and response activities spanning planning, intelligence, detection engineering, investigation, containment, recovery, and lessons learned to protect information, minimize business disruption, and strengthen operational resilience.

The position combines technical leadership with hands-on operational accountability. It develops team capabilities, strengthens response plans and playbooks, and establishes clear ownership, timely escalation, and effective communication during complex incidents. The Lead partners with Technology, business functions, and external providers to use incident insights for practical improvements aligned with evolving threats and business needs.

The position is available to Virginia residents as a Richmond, Virginia hybrid role, or to remote applicants residing in North Carolina, Maryland, Virginia, or the DC Metro area. Employees within 50 miles of a Genworth | CareScout office are expected to work a hybrid schedule, with core hours targeting 9 a.m.–5 p.m. EST. Applicants outside the 50-mile radius should expect approximately 25% travel. The role requires availability to support incident escalations outside normal business hours. It is not eligible for employment visa sponsorship.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or 7+ years of equivalent relevant experience.
• Significant progressive experience in cybersecurity operations and incident response, including leadership of a CSIRT or comparable response function.
• Demonstrated experience directing complex cybersecurity incidents and coordinating responses across technical teams, business stakeholders, and external partners.
• Strong technical knowledge of incident investigation, containment, eradication, and recovery across endpoint, network, identity, and cloud environments.
• Experience with security monitoring and investigation technologies, including SIEM, EDR, and security orchestration and automation tools.
• Working knowledge of digital forensics, evidence handling, threat intelligence, and attacker tactics, techniques, and procedures.
• Experience developing incident response plans, playbooks, escalation frameworks, readiness exercises, and performance measures.
• Ability to lead and develop technical professionals, establish operational discipline, and maintain clear accountability during high-pressure situations.
• Strong judgment and communication skills, including the ability to explain technical issues, business impacts, and response decisions to senior leaders and nontechnical audiences.
• Experience in a regulated environment, preferably financial services or insurance, including partnering with Legal, Privacy, Risk, and Compliance on incident-related requirements.
• Ability to support incident escalations outside normal business hours.

Nice To Haves

• Relevant certifications such as CISSP, GCIH, GCFA, or comparable incident response credentials.

Responsibilities

• Lead the CSIRT, set priorities, develop team capabilities, and establish accountability for incident readiness and response.
• Direct cybersecurity incident response from initial triage and investigation through containment, eradication, recovery, and post-incident review.
• Coordinate incident response across Cybersecurity, Technology, business teams, and external partners, ensuring ownership, timely escalation, and effective handoffs.
• Maintain and enhance incident response plans, playbooks, severity criteria, and escalation procedures.
• Serve as a primary escalation point for significant cybersecurity incidents and communicate technical findings, business impacts, response options, and leadership updates.
• Partner with Legal, Privacy, Compliance, Risk, Communications, and Business Continuity teams on incident decisions, notification assessments, and recovery coordination.
• Guide incident investigations, including evidence preservation, forensic analysis, and documentation, engaging internal specialists and external providers as needed.
• Lead tabletop exercises and response simulations to test readiness, clarify responsibilities, and address gaps.
• Use incident trends, threat intelligence, and lessons learned to strengthen detection and response capabilities, improve playbooks, and reduce recurring issues.
• Establish response metrics and reporting, oversee incident response service providers, and improve response speed, quality, and operational resilience.
• Leverage AI and automation to identify and respond to cybersecurity threats at machine speed.

Benefits

• Competitive compensation and total rewards incentives; role is eligible for a bonus incentive plan based on individual and company performance, not guaranteed.
• Comprehensive healthcare coverage.
• Multiple 401(k) savings plan options.
• Automatic enrollment in an employer-directed retirement account feature that is 100% employer-funded.
• Generous paid time off, including 12 paid holidays, volunteer time off, and paid family leave.
• Disability, life, and long-term care insurance.
• Tuition reimbursement, student loan repayment, and training and certification support.
• Wellness support, including gym membership reimbursement and Employee Assistance Program resources for work/life support and financial and legal management.
• Caregiver and mental health support services.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior