Director of Cyber Security Operations

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee enterprise-level monitoring operations, encompassing 24×7 SOC management, real-time detection and alerting, telemetry enhancement, and automation.

• Lead incident response and digital forensics initiatives, coordinating actions for containment, eradication, and recovery.

• Manage executive and regulatory communications during significant security incidents.

• Assist with vulnerability management, secure configuration standards, patch governance, system integrity, authorized changes, and compliance alignment.

• Design and implement SIEM, SOAR, and AI/ML-driven security platforms and analytics.

• Supervise cloud-native and hybrid security operations across AWS, Azure, and GCP.

• Integrate DevSecOps practices, workload segmentation, and identity governance within cloud environments.

• Establish and communicate cyber-risk posture to executive leadership and regulatory entities.

• Promote cybersecurity process automation, technology upgrades, predictive detection, and orchestration.

• Develop, mentor, and lead cybersecurity teams focused on monitoring, response, engineering, and cloud disciplines.

• Merge cybersecurity operations with infrastructure and IT processes, alongside unified incident management workflows.

• Act as a representative for the organization in audits, examinations, and crisis situations.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related discipline is required.

• Professional certification is necessary, such as GSOM, GSOC, CISSP, CISA, CISM, or an equivalent qualification.

• At least 10 years of experience in leading enterprise-level monitoring operations, including 24×7 SOC management, detection and alerting, telemetry and log pipeline optimization, and automated response procedures.

• A minimum of 10 years of experience in directing incident response and forensics activities, which includes handling major incidents, collecting digital evidence, conducting post-mortem analyses, engaging with executives and regulators, and managing threat containment and eradication.

• At least 10 years of experience designing and operationalizing security platforms and tools, including SIEM/SOAR, AI/ML analytics, enterprise security solutions, and technical roadmaps.

• A minimum of 6–10 years of experience managing enterprise-level risk-reduction initiatives, vulnerability management, compliance alignment, secure configuration baselining, patch governance, and audit remediation.

• At least 6–10 years of experience overseeing cloud-native cybersecurity operations across AWS, Azure, and GCP, with a focus on DevSecOps, hybrid infrastructure compliance, identity management, access control, and workload isolation.

• Candidates must be eligible to work in the US without requiring employer sponsorship, now or in the future.

• Extensive knowledge in Security Operations Center design and management.

• Advanced skills in incident response leadership and digital forensics.

• Proven capability to design and maintain SIEM and SOAR platforms, including Splunk, Power Automate, scripting, and KQL.

• Strong understanding of AI/ML integration in cybersecurity, behavior-based analytics, anomaly detection, and applications of large language models.

• Expertise in vulnerability management, threat-based prioritization, patch lifecycle governance, secure configuration standards, and threat detection.

• In-depth knowledge of secure cloud architecture and DevSecOps practices across AWS, Azure, and GCP.

• Proficient in digital forensics and evidence preservation, including analysis of memory, disk, and network artifacts.

• Ability to lead cybersecurity risk governance in alignment with NIST CSF, ISO 27001, SOC 2, and FHFA/Fed examination requirements.

• Strong command of cybersecurity automation and orchestration frameworks.

• Comprehensive knowledge of identity and access management, least-privilege enforcement, and privileged-access controls.

• Experience in implementing and fine-tuning DLP, insider risk, and threat intelligence programs.

• Proficiency in security metrics and KPI development.

• Skills in leading cross-functional programs.

• Expertise in vendor and third-party risk management.

• Ability to design and execute cybersecurity testing and validation programs, including tabletop exercises and red team coordination.

• Strong communication skills and ability to present to executives.

• Proven track record of innovation and continuous improvement through automation, ML/AI, and analytics.

• Exceptional leadership and team-building capabilities.

🏝️ Benefits

• Performance bonus.

• 401(k) matching.

• Healthcare coverage.

• Paid time off (PTO).

• Competitive total compensation package.

• Background investigation and potential credit check as a condition of employment.