Director Cybersecurity Jobs

About The Position

Requirements

• BA/BS plus at least 14 years of relevant experience, or demonstrated equivalency of experience and/or education, plus at least 6 years of leadership experience.
• In-depth experience leading security incident response processes in cloud, virtualized, and on-premises environments.
• Extensive direct experience managing and responding to complex technical cybersecurity incidents in high-pressure situations.
• Experience with SIEM, SOAR, and EDR platforms and detection engineering practices.
• Working knowledge of AI and machine learning applied to security operations, including large language model and agent-based tools and associated risks such as accuracy, data privacy, prompt injection, and auditability.
• Understanding of current and emerging threats and countermeasures through relationships with cyber threat teams and vendors, including directing a team in applying threat intelligence to proactively mitigate risk.
• Ability to develop and present accurate, timely information to stakeholders outlining technical solutions, recommendations, and conclusions.
• US citizenship is required.
• Exceptional written and verbal presentation skills, including the ability to explain complex technical issues concisely to technical personnel and executive-level management.
• Exceptional leadership skills and the ability to lead, manage, and grow a global cyber security operations center and incident response program.
• Advanced critical thinking and decision-making ability, including the ability to explain and defend complex decisions.
• Ability to operate autonomously within the scope of the role; highly motivated and self-sufficient.

Nice To Haves

• Proven skills in incident response, including computer intrusion investigations and digital forensics in enterprise environments.
• Strategic planning and commercial acumen, including sourcing strategy, vendor negotiation, and financial management including MSSP management.
• Experience with similarly large, complex, global organizations.

Responsibilities

• Lead, manage, and mature the people, processes, and technologies of a 24x7 global security operations center, including internal staff and managed service providers.
• Own the MxDR operating model, including defining requirements, leading vendor selection, transitions, and renewals, and holding providers accountable to service levels, remedies, and cost targets.
• Direct detection engineering across SIEM, SOAR, and EDR, including log-source coverage, MITRE ATT&CK coverage, and automation to reduce time to detect and respond.
• Define and lead the strategy for incorporating AI into the SOC, including AI-assisted triage, investigation, detection engineering, and automation, with governance, guardrails, and human oversight; measure outcomes such as time to triage, time to respond, and analyst workload.
• Evaluate and select AI capabilities from technology and managed-service providers and hold providers accountable for AI-enabled service improvements and cost.
• Lead threat-intelligence-led operations, including threat intelligence, proactive threat hunting, and digital risk and dark web monitoring.
• Develop and direct the Enterprise Incident Response Program and ensure its continued maturity.
• Collaborate with stakeholders such as Crisis Management and Business Continuity on security initiatives, assessments, and resilience testing.
• Define and maintain dashboards and metrics that support Incident Response Program and Cyber Security Operations Center maturity, and report performance to leadership.
• Manage the operating budget and vendor spend and build business cases for service and sourcing changes.
• Provide cybersecurity briefings, status updates, and consultancy to technical and executive leadership audiences.
• Use the incident response program to conduct cyber tabletop simulations and educational sessions with stakeholders.
• Provide leadership for incident response investigations, coordinate response activity, and brief senior leaders while maintaining confidentiality.
• Lead, manage, and grow a global cyber security operations center and incident response program; maintain crisis-focused relationships and communication channels.
• Run services to defined metrics and service levels and drive continuous improvement and automation.

Benefits

• Medical, dental, vision, life, AD&D, and disability benefits (depending on employment status).
• Paid time off and leaves of absence (depending on employment status).
• Voluntary benefits and perks.
• Flexible work options.
• Well-being resources and employee assistance program.
• Business travel insurance.
• Service recognition awards.
• Retirement savings plan.
• Employee stock purchase plan.
• Training and development programs.