Sr Director, Cybersecurity Defense & Response (Hybrid - Dallas TX)

AECOM•Dallas, TX

8d•Hybrid

About The Position

The Sr Director, Cyber Defense & Response leads the day-to-day operations and continued evolution of AECOM’s Cyber Incident Response program, Global Cyber Security Operations Center, and Managed Extended Detection and Response (MxDR) services. The position is accountable for timely and effective responses to security threats and incidents, the performance of internal and third-party security operations providers, and threat-intelligence-led detection capabilities. It also sets and drives the strategy for applying AI to security operations with appropriate governance and human oversight. The role combines strategic ownership of the cyber defense roadmap and sourcing model with operational excellence, including measurable service levels, detection engineering, and automation. The Sr Director serves as a subject matter expert in cyber forensics, industry best practices, and incident response. The position is based in Dallas, Texas, and offers a hybrid work schedule with both in-office and remote work. AECOM is a global infrastructure consulting firm with more than 50,000 professionals. It works with public- and private-sector clients across water, environment, energy, transportation, and buildings to deliver advisory, planning, design, engineering, program management, and construction management services. The company reports fiscal year 2025 revenue of $16.1 billion.

Requirements

BA/BS degree plus at least 14 years of relevant experience, or demonstrated equivalency of experience and/or education, plus at least 6 years of leadership experience.
In-depth experience leading security incident response processes in cloud, virtualized, and on-premises environments.
Extensive direct experience managing and responding to complex technical cybersecurity incidents in high-pressure situations.
Experience with SIEM, SOAR, and EDR platforms and detection engineering practices.
Working knowledge of AI and machine learning applied to security operations, including large language model and agent-based tools and their risks, such as accuracy, data privacy, prompt injection, and auditability.
Understanding of current and emerging threats and countermeasures through relationships with cyber threat teams and vendors, including directing a team in applying threat intelligence to proactively mitigate risk.
Ability to develop and present accurate, timely information to stakeholders outlining technical solutions, recommendations, and conclusions.
US citizenship is required.
Unwavering focus and crisis-management skills, including the ability to manage relationships and communication channels.
Exceptional written and verbal presentation skills, with the ability to explain complex technical issues concisely to technical staff and executive-level management.
Exceptional leadership skills and the ability to lead, manage, and grow a global cybersecurity operations center and incident response program.
Demonstrated operational excellence running services to defined metrics and service levels and driving continuous improvement and automation.
Advanced critical-thinking and decision-making ability, including the ability to explain and defend complex decisions.
Ability to work autonomously within the scope of the role.

Nice To Haves

Proven skills in incident response, including computer intrusion investigations and digital forensics in enterprise environments.
Strategic planning and commercial acumen, including sourcing strategy, vendor negotiation, and financial management, including MSSP management.
Experience in similarly large, complex, global organizations.

Responsibilities

Lead, manage, and mature the people, processes, and technologies of a 24x7 global security operations center, including internal staff and managed service providers.
Own the MxDR operating model, including requirements, vendor selection, transitions, renewals, service levels, remedies, and cost targets.
Direct detection engineering across SIEM, SOAR, and EDR, including log-source coverage, MITRE ATT&CK coverage, and automation to reduce time to detect and respond.
Set and lead the strategy for incorporating AI into the SOC, including AI-assisted triage, investigation, detection engineering, and automation, with governance, guardrails, human oversight, and outcome measurement.
Evaluate and select AI capabilities from technology and managed service providers, and hold providers accountable for AI-enabled service improvements and cost.
Lead threat-intelligence-led operations, including threat intelligence, proactive threat hunting, and digital risk and dark web monitoring.
Develop and direct the Enterprise Incident Response Program and ensure its continuous maturity.
Collaborate with Crisis Management, Business Continuity, and other stakeholders on security initiatives, assessments, and resilience testing.
Define and maintain dashboards and metrics for Incident Response Program and Cyber Security Operations Center maturity, and report performance to leadership.
Manage the operating budget and vendor spending, and build business cases for service and sourcing changes.
Provide cybersecurity briefings, status updates, and consultancy to technical and executive leadership audiences.
Use the incident response program to conduct cyber tabletop simulations and educational sessions with stakeholders.
Lead incident response investigations, coordinate response activity, and brief senior leaders while maintaining confidentiality.
Lead, manage, and grow a global cybersecurity operations center and incident response program.
Run services to defined metrics and service levels and drive continuous improvement and automation.
Manage relationships and communication channels during crises, and make and explain complex decisions.