Director Cybersecurity Operations

For more than 65 years, we've turned big ideas into solutions that help protect homes, strengthen businesses and build a more resilient, efficient, sustainable energy future.

Ready to Power a Smarter World with us?

Responsibilities to include: 

Security Operations Center Leadership:

• Provide strategic and operational leadership of the global security operations center, establishing the vision, operating model, and maturity roadmap for a world class detection and response capability

• Establish and monitor performance objectives for the operations function, including detection coverage, alert quality, and response time targets, with continuous improvement against measurable outcomes.

Incident Response Strategy and Execution 

• Own strategic direction of the enterprise Incident Response function, including playbooks, escalation paths, tabletop and technical exercises, and executive communications. 

• Partner with XDR service providers and managed security services to deliver around the clock detection and response coverage, ensuring clear roles, service levels, and accountability across internal and external teams.

• Lead major incident response engagements, coordinating internal, managed service, and external partner resources through containment, eradication, recovery, and lessons learned. SOAR and AI Enabled Operations 

• Mature the operations function by establishing SOAR capabilities that automate triage, enrichment, and response actions to reduce mean time to detect and mean time to respond. 

• Leverage AI capabilities to augment analyst workflows, improve signal quality, and scale the operations team to meet the demands of the modern threat landscape. 

Cybersecurity Engineering Leadership

• Lead the Cybersecurity Engineering teams responsible for managing enterprise security technology capabilities, including endpoint, network, cloud, identity, and email security platforms.

• Drive engineering standards for deployment, configuration, lifecycle management, and health monitoring of security technologies across a global environment. 

SIEM and Telemetry Management

• Own the strategy for integrating and rightsizing telemetry into the SIEM, ensuring the right sources, parsing, enrichment, and retention to support timely reporting and automation.

• Continuously evaluate telemetry value against cost, tuning ingestion and detection content to keep pace with, or ahead of, threats as they emerge. Threat Detection and Intelligence 

• Establish detection engineering practices that translate threat intelligence into high quality detections mapped to industry frameworks such as MITRE ATT&CK.

• Operationalize threat intelligence to prioritize detection coverage, threat hunting, and response readiness for the threats most relevant to the business. Managed Services and Vendor Governance

• Govern the performance of XDR, managed detection and response, and incident response retainer partners through defined service levels, quality reviews, and continuous improvement plans. 

• Right size the balance of internal and external capabilities to optimize cost, coverage, and institutional knowledge. 

Team Leadership and Development 

• Build, lead, and develop high performing global engineering and operations teams, including hiring, mentoring, performance management, and succession planning. 

• Establish a sustainable surge and after hours response model that is well practiced and supported by clear procedures, training, and tooling. Metrics, Reporting, and Continuous Improvement 

• Define and report key operational metrics for executive and board level audiences, tying operational performance to measurable risk reduction. 

• Drive post incident reviews and continuous improvement across people, process, and technology.

Collaboration and Enterprise Alignment 

• Partner with enterprise cybersecurity functions, including governance risk and compliance, product security, and regional security leaders, to align operations with enterprise strategy and compliance obligations.

• Support audit, regulatory, and customer assurance activities with timely evidence and operational expertise.

Minimum Job Requirements

Education

Work Experience

• 10 years of progressive experience in cybersecurity, with at least 5 years leading security operations, incident response, or security engineering functions. 

• Demonstrated leadership of global teams spanning engineering and operations disciplines.

• Experience directing enterprise incident response, including major incident command and coordination with external incident response partners, legal counsel, and executive leadership

• Experience managing XDR, MSSP, or managed detection and response service providers, including contract, service level, and performance management. 

• Experience implementing or operating SOAR platforms and SIEM technologies at enterprise scale, including telemetry onboarding, detection engineering, and automation.

• Experience with industry security best practices and frameworks, including but not limited to NIST CSF, MITRE ATT&CK, and ISO 27001.

• Knowledge / Skills / Abilities

• Excellent communication and collaboration skills, with the ability to brief executives during high pressure incidents and translate technical detail into business terms.

• Strong understanding of modern security operations, including detection engineering, automation, and the application of AI to security operations workflows.

• Strong analytical and problem solving skills, with the ability to make sound decisions quickly under pressure.

Preferred Job Requirements

Education

Certification / License

• CISSP, CISM, or GIAC certifications such as GCIH or GCED, or equivalent

• Work Experience

• Leadership of a large scale security operations center or managed detection and response function.

“We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, disability status, protected veteran status, or any other characteristic protected by law.”