Vice President, Cyber Threat, Offensive Security & Incident Response (Hybrid)

Globe Life • McKinney, TX

6d • Hybrid

About The Position

Globe Life is seeking a Vice President to lead its enterprise cyber threat intelligence, offensive security, incident response, and Continuous Threat Exposure Management (CTEM) programs. As a member of the Chief Information Security Officer’s (CISO) leadership team, the role sets the strategic vision for identifying and reducing cyber threats, directs the Company’s response to significant security incidents, and strengthens enterprise resilience. The position leads specialized cybersecurity teams, collaborates with executive leadership, and drives measurable improvements in threat detection, security control effectiveness, and organizational risk reduction.

The Vice President establishes a three-to-five-year operating model and investment roadmap; owns governance for incident response, offensive testing, and exposure management; and is accountable for enterprise cybersecurity readiness and resilience outcomes. The role leads offensive security and AI security testing, validates security controls, develops threat intelligence, and oversees incident response and CTEM operations. It also serves as incident commander for significant incidents and may act as the CISO’s delegate for cyber crisis matters.

The role builds and develops a multi-layer cybersecurity organization across CTI, incident response, and offensive security; owns its budget, tooling strategy, and external partnerships; and advises senior technology, business, and executive leaders on cyber risk and response. This is a hybrid position in McKinney, Texas, with work from home Monday and Friday and in-office work Tuesday through Thursday.

Requirements

• Bachelor’s degree in Information Security, Computer Science, Information Technology, Cybersecurity, or a related field.
• At least 15 years of information security experience, including eight or more years across offensive security, cyber threat intelligence, or incident response.
• At least eight years of cybersecurity leadership experience, including five or more years managing managers and leading multi-layer organizations with budget accountability.
• Demonstrated ability to influence senior executives and the Board and drive remediation outside direct reporting lines.
• Demonstrated experience as a senior leader or incident commander for major security incidents, including coordination with Legal, executives, regulators, and external responders.
• Demonstrated experience setting multi-year cybersecurity strategies and building or transforming security functions with measurable outcome improvements.
• Experience engaging regulators, auditors, law enforcement, or industry organizations such as FS-ISAC on cybersecurity matters.
• Expert knowledge of incident response methodologies, frameworks, and best practices, including the NIST Cybersecurity Framework, SANS Incident Response, and ISO 27035.
• Deep understanding of cyber threat landscapes, threat actor tactics, techniques, and procedures, and frameworks such as MITRE ATT&CK.
• Technical expertise in digital forensics, malware analysis, and investigative techniques across Windows, Linux, and cloud environments.
• Comprehensive understanding of network protocols, security architectures, and enterprise IT infrastructure, including on-premises and cloud environments.
• Knowledge of threat intelligence sources, platforms, and analysis techniques to identify and prioritize relevant threats.
• Sound judgment and crisis leadership, including the ability to assess complex incidents and make critical decisions under pressure with incomplete information.
• Exceptional executive communication and Board-level presentation skills, including the ability to explain incidents, threat information, and risk to executive, regulatory, and non-technical audiences.
• Strong stakeholder management and influencing skills to coordinate cross-functional efforts and secure remediation commitments from leaders outside direct reporting lines.
• Working knowledge of regulatory requirements and compliance standards applicable to financial services and insurance, including breach notification and incident materiality requirements.
• Hands-on depth in red teaming, penetration testing, or adversary emulation, with working knowledge of MITRE ATT&CK.
• Experience leading significant cybersecurity incidents from initial detection through containment, recovery, and post-incident improvement.
• Experience building or running a threat intelligence function and translating intelligence into defensive actions.
• Experience testing AI and LLM-based systems, including familiarity with OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Experience operating CTEM or exposure management programs, including attack path analysis, breach and attack simulation, and automated penetration testing platforms.
• Strategic planning and operating model design experience, including multi-year roadmaps, maturity models, and outcome-based metrics.
• Financial and vendor management experience, including budget ownership, business case development, and negotiation of retainers and managed services.
• Leadership experience managing managers and multi-layer teams, including talent development, succession planning, and fostering accountability and continuous improvement.
• A CISSP or GIAC Security Expert (GSE) certification.
• Reliable and predictable attendance of the assigned shift.
• Ability to work full time and/or part time based on position specifications.

Nice To Haves

• Master’s degree in a related field or an MBA.
• Experience in financial services, insurance, or another highly regulated industry.
• GIAC certifications such as GCFA or GCIA, or advanced offensive security certifications such as GXPN or OSCP.
• Additional relevant certifications such as CISM, CISO, CEH, or vendor-specific certifications.

Responsibilities

• Establish the strategic vision, three-to-five-year operating model, and investment roadmap for threat intelligence, offensive security, incident response, and exposure management, aligned with the CISO’s strategy, risk appetite, and business priorities.
• Define and report enterprise cybersecurity readiness and resilience metrics, including detection and containment, validated-exposure remediation, priority-threat detection coverage, and control validation results.
• Own policies, standards, and governance forums for incident response, offensive testing, and exposure management, and help shape enterprise security policies and cyber risk appetite.
• Serve on the CISO’s leadership team and act as the CISO’s delegate for cyber crisis matters when required.
• Anticipate emerging threats and technology developments, including AI, and adjust security strategies, capabilities, and investments.
• Define and lead the multi-year offensive security strategy and annual testing roadmap, covering critical business services and aligning with business priorities, risk appetite, and regulatory expectations.
• Direct red team operations, purple team exercises, penetration testing, and adversary emulation across applications, infrastructure, cloud environments, identities, and third-party connections.
• Establish offensive security governance, including scope, rules of engagement, safety controls, success metrics, and approval processes for high-risk activities, in coordination with Legal, Privacy, and business owners.
• Build enterprise AI security testing capabilities for AI systems, LLM-enabled applications, AI agents, and third-party AI services; test risks including prompt injection, data leakage, model abuse, insecure agent permissions, and supply-chain risks.
• Partner with technology, data, and governance leaders to set security testing requirements before AI capabilities reach production, and establish safeguards for AI and automation in offensive security operations.
• Own continuous security-control effectiveness testing and establish procedures with Information Security Risk for incorporating results into the risk register, reassessing risk ratings when controls fail, and retesting before ratings are lowered.
• Lead recurring validation of critical detection and response controls through penetration testing, adversary emulation, and purple team exercises; partner with the SOC and detection engineering teams to monitor coverage improvements.
• Provide evidence of control effectiveness to internal audit, external auditors, risk management, regulators, and the Board, serving as a senior point of contact for testing and validation activities.
• Build, lead, and mature the enterprise cyber threat intelligence program, providing strategic, operational, and tactical intelligence on threats affecting Globe Life and its industries.
• Own the enterprise threat model and prioritized threat actor profiles, and use intelligence to guide security investments and priorities across the CISO organization.
• Translate intelligence into red-team emulation plans, SOC threat hypotheses and detection requirements, and CTEM exposure priorities.
• Track exploitation of newly disclosed vulnerabilities, drive rapid exposure assessments, and escalate risk decisions to executive leadership when warranted.
• Deliver decision-ready threat briefings for the CISO, executives, and Board; own intelligence sources and sharing relationships, including representation with FS-ISAC, law enforcement, and peer institutions.
• Own the enterprise cyber incident response program, including response plans, playbooks, severity models, and escalation procedures for ransomware, data exfiltration, business email compromise, fraud, and AI system compromise.
• Integrate incident response with enterprise crisis management, business continuity, and disaster recovery.
• Serve as incident commander for significant cybersecurity incidents, coordinating IT, Legal, Privacy, Compliance, Communications, business units, and third-party responders through containment, investigation, and recovery.
• Make time-critical containment decisions, including decisions affecting business operations, and escalate significant incidents to the CISO and executive leadership as defined by the severity model.
• Partner with Legal, Compliance, and Finance to support incident materiality assessments and regulatory notification decisions.
• Oversee digital forensics and root-cause analysis, and coordinate relationships and retainers with incident response firms, forensic specialists, breach counsel, and cyber insurance carriers.
• Run enterprise tabletop exercises for technical teams, management, and executive leadership, and use lessons learned to improve readiness.
• Ensure significant incidents result in documented corrective actions, executive ownership, and follow-up that informs detection engineering, offensive testing, and CTEM priorities.
• Set the strategy for and operate the organization-wide CTEM program so exploitable exposures are identified, prioritized, validated, and addressed in a timely manner.
• Lead threat-informed scoping of CTEM cycles around likely target attack surfaces and business services.
• Partner with vulnerability management and attack surface management teams to prioritize exposures by exploitability and business impact, not severity scores alone.
• Direct validation using attack path analysis, automated penetration testing, and red team techniques to confirm exploitability and the effect of controls.
• Secure remediation commitments from IT and business owners, resolve competing priorities, and escalate unresolved risks through risk acceptance processes.
• Report exposure reduction, remediation progress, and program effectiveness to executive leadership.
• Advise senior IT, infrastructure, application, and business leaders, securing commitment to address validated risks, including when remediation competes with other priorities.
• Brief executive leadership on the threat landscape, significant incidents, and control effectiveness, translating technical risks into business implications and recommendations.
• Build, lead, and develop a high-performing multi-layer organization across CTI, incident response, and offensive security, including managers and senior technical leaders.
• Set expectations for workforce planning, hiring, performance management, succession planning, career development, and team accountability.
• Own the function’s budget, tooling strategy, and external partnerships, and operate within governance and financial controls for vendor management, budget development, and demonstrating investment value.
• Collaborate with Information Security Risk and Information Security Architecture on risk assessment data and security control design.
• Partner with Legal, Compliance, Privacy, Internal Audit, Enterprise Risk, Technology, Communications, and Human Resources on enterprise cyber risk and crisis response.

Benefits

• Competitive compensation designed to reflect expertise and contribution.
• Comprehensive health, dental, and vision insurance plans.
• Life insurance benefits and retirement plans, including company-matched 401(k) and a pension plan.
• Paid holidays and time off.
• Parental leave.
• Subsidized fitness, mindfulness, nutrition, and sleep subscriptions.
• Company-paid counseling for mental health, stress management, and work-life balance.
• Continued education reimbursement eligibility and company-paid FLMI and ICA courses.
• Discounted Texas Rangers tickets.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive