• Lead the cybersecurity operations and security engineering function across corporate, cloud, hybrid, and production environments.
• Manage and develop security engineers and analysts responsible for monitoring, detection, response, infrastructure security, vulnerability management, and operational security controls.
• Own monitoring, detection, and response capabilities, including SIEM, EDR/XDR, DLP, vulnerability management, firewall, WAF, email security, identity security, and cloud security tooling.
• Serve as the operational control point during significant cybersecurity incidents, coordinating response across Security, IT, Engineering, Legal, Communications, GRC, and executive stakeholders.
• Develop, maintain, and test incident response playbooks, escalation paths, tabletop exercises, on-call procedures, and post-incident review processes.
• Lead post-incident reviews and ensure root-cause remediation, lessons learned, and control improvements are completed.
• Evaluate, implement, and optimize security solutions across endpoint, identity, network, email, cloud, logging, detection, and response platforms.
• Partner with IT and Engineering to strengthen cloud, hybrid, and corporate security controls, including identity, network segmentation, key management, secrets management, privileged access, endpoint hardening, and secure configuration management.
• Support GovRAMP and PCI DSS control requirements related to logging, monitoring, vulnerability management, incident response, endpoint security, access control, encryption, cloud security, configuration management, and evidence collection.
• Drive measurable risk reduction across infrastructure, endpoints, cloud environments, identity systems, and business-critical services.
• Own operational vulnerability management processes for infrastructure, cloud, endpoint, and corporate systems.
• Support business continuity, disaster recovery, and resilience planning from a cybersecurity perspective.
• Manage cybersecurity operations budget inputs, including vendor evaluation, renewals, tool rationalization, and investment recommendations.
• Develop operational security metrics and reporting for executive leadership, including incident trends, vulnerability risk, detection coverage, response performance, control health, and remediation progress.
• Stay ahead of evolving threats, including cloud-native attacks, identity compromise, ransomware, AI-enabled threats, and emerging attacker techniques.
• Participate in or manage the security on-call rotation.
