VP, Cyber Intelligence Leader

Synchrony•Orlando, FL

2d•$170,000 - $290,000•Hybrid

About The Position

The VP, Cyber Intelligence Leader leads Synchrony’s Cyber Threat Intelligence (CTI), Detection Engineering, and Cyber Hunt programs. The role translates external and internal threat signals into actionable intelligence, proactive hunts, and measurable detection improvements across the enterprise. It partners with Synchrony’s Joint Security Operations Center (JSOC), Incident Response, Vulnerability Management, and infrastructure and application teams to reduce adversary dwell time and strengthen cyber defenses. The leader will define cohesive, multi-year strategies to evolve intelligence processes in response to emerging technologies, including artificial intelligence. The ideal candidate has financial-sector cyber intelligence and broad information security expertise. The position defines intelligence requirements and collection plans, produces strategic, operational, and tactical intelligence, and manages the intelligence lifecycle. It leads hypothesis-driven hunts and detection engineering, translating findings into durable detection, data, and control improvements. The leader establishes standards, testing and tuning processes, metrics, documentation, and release cadence, while coordinating with the SOC and Incident Response to improve alert quality and response outcomes. The role offers flexibility to work from home near a Synchrony Hub or from an office, with required travel to the nearest Hub for in-person business or team meetings, training, and culture events. Business travel may also be required. The position is eligible for an annual bonus based on individual and company performance. The stated annual salary range is $170,000–$290,000; actual compensation depends on experience, skills, and knowledge, with adjustments for markets in California, the New York Metro area, and Seattle.

Requirements

Bachelor’s degree in computer science or an equivalent degree and a minimum of 5 years of work.
8–12+ years of cybersecurity experience, with depth in threat intelligence, threat hunting, detection engineering, and/or incident response.
3+ years leading teams and/or enterprise programs with measurable outcomes.
Demonstrated experience building and operationalizing detections in a SIEM/EDR environment and partnering with SOC/Incident Response.
Strong knowledge of adversary tactics and frameworks, including MITRE ATT&CK, and applying them to detection coverage.
Proficiency working with security telemetry across endpoint, network, cloud, and edge environments; strong investigative mindset.
Strong written and verbal communication skills, including the ability to brief executives and produce clear technical documentation and runbooks.
Ability and flexibility to travel for business as required.
At least 18 months in position before internal employees at level 8 or greater may post for other roles; internal applicants must meet performance expectations and have manager approval, subject to stated exceptions.
Legal authorization to work in the U.S.; the company will not sponsor employment visas for this opening.
Must be 18 years or older, have a high school diploma or equivalent, be willing to take a drug test and undergo a background investigation and fingerprinting, and satisfy Section 19 of the Federal Deposit Insurance Act.

Nice To Haves

Experience establishing a detection engineering lifecycle, including standards, testing, tuning, change control, and coverage reporting.
Detection content engineering expertise; familiarity with data models, normalization, and scalable detection design.
Financial services and/or regulated-industry experience, with an audit-ready documentation and governance mindset.
Certifications such as GIAC (GCTI/GCIA/GCIH/GNFA), CISSP, CCSP, or similar.
Strong technical knowledge of scripting languages and data access methodologies.
Awareness of the latest cybersecurity trends and developments.
U.S. Government Security Clearance.

Responsibilities

Define intelligence requirements and collection plans focused on threats relevant to financial services and Synchrony’s environment.
Produce strategic, operational, and tactical intelligence, including executive reporting, actor and campaign tracking, and TTP and IOC packages.
Translate intelligence into detection content, hunt hypotheses, response playbooks, and prioritized mitigations.
Manage the intelligence lifecycle from collection through analysis, production, dissemination, and feedback.
Lead hypothesis-driven hunts mapped to MITRE ATT&CK, focused on high-risk scenarios and validated by available telemetry.
Coordinate hunts across endpoint, network, cloud, identity, and edge/WAF environments, and document repeatable hunt playbooks.
Escalate validated suspicious activity to Incident Response and support containment and remediation as needed.
Convert hunt findings into durable improvements, including detections, data onboarding and enrichment, and control remediation.
Lead a detection engineering function responsible for building and maintaining enterprise detection content and analytics.
Develop detection standards for naming, severity, testing criteria, evidence requirements, and runbooks, along with a structured tuning process.
Ensure detections are threat-informed, ATT&CK-mapped, measurable, and aligned with JSOC workflows and triage capacity.
Drive detection validation using purple-team and attack-simulation outcomes and lessons learned from real incidents.
Partner with the SOC to improve alert fidelity, reduce noise, and ensure clear escalation criteria and responder guidance.
Maintain a detection backlog and release cadence, ensuring change control and documentation for auditability.
Perform other duties and/or special projects as assigned.