Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

Description

The role is based in Brea, CA, which is moving to Irvine, CA in approximately Q1 2028. You must live within a reasonable commute of both sites. The job is fully onsite, with no hybrid or remote option, and you will be in the office 4 days per week.

The company is a global dental industry leader with more than 30 brands. Its portfolio spans technologies, consumables and services for dental professionals. One brand has supported clinicians for over 135 years, another is a pioneer in digital orthodontics, and others are known for dental implants and imaging.

You will be the senior technical expert for security operations, detection engineering, incident response and security platforms. You will work with a high degree of autonomy. You will turn the direction set by the Global Head of Information Security & GRC into scalable capabilities, operating models, roadmaps and measurable results. The Global Head of Information Security & GRC keeps final accountability for the overall cybersecurity strategy.

You will lead the domain for the internal SOC, the incident response program, the detection lifecycle and the security tooling stack. You will recommend priorities and investments and shape enterprise decisions through technical judgment.

Responsibilities

• Lead enterprise security operations, covering monitoring, triage, investigation, escalation and response.
• Define and manage the operating model for the internal SOC and MSSP or MDR partners. This includes service strategy, SLAs, alert quality, escalation paths, accountability and performance.
• Design and grow a scalable 24x7 monitoring model that fits enterprise risk, business priorities and the cybersecurity strategy set by the Global Head of Information Security & GRC.
• Define KPIs and KRIs, including MTTD, MTTR, alert fidelity, detection coverage and response effectiveness.
• Propose the domain strategy, priorities and investment roadmap for approval by the Global Head of Information Security & GRC.
• Build the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security and cloud security platforms.
• Automate triage, enrichment, containment and reporting workflows.
• Set technical principles, standards and decision frameworks for security operations and engineering across the enterprise.
• Define the enterprise logging and telemetry strategy, covering onboarding, parsing, normalization, retention and coverage standards.
• Assess capability gaps and recommend platform investments, consolidation, modernization or retirement based on risk, business value and cybersecurity priorities.
• Lead the enterprise incident response program, including playbooks, exercises, breach workflows and communications, within the governance and escalation framework set by the Global Head of Information Security & GRC.
• Direct containment, eradication, recovery and root cause analysis for major incidents, and advise executives on response options and business impact.
• Make sure post-incident reviews lead to lasting control improvements.
• Create response strategies for novel events where existing playbooks fall short.
• Coordinate with Legal, Privacy, HR, IT and Communications during incidents.
• Build the detection engineering lifecycle: hypothesis, development, testing, tuning, deployment, validation and retirement.
• Develop behavior-based, threat-informed detections mapped to MITRE ATT&CK.
• Extend monitoring across endpoint, identity, cloud, SaaS, network and critical applications.
• Spot emerging detection gaps and build threat-informed solutions using red team, penetration testing, vulnerability, incident and external threat intelligence.
• Shape exposure management, asset inventory visibility and attack surface monitoring.
• Run continuous control monitoring and validate key security controls.
• Improve vulnerability remediation workflows and the risk reduction they deliver.
• Produce measurable gains in cyber resilience, operational continuity and material-risk reduction across business units and technology environments.
• Build and lead high-performing security operations and engineering teams and strategic partners, acting as the senior technical leader for the domain.
• Design and put in place the operating model for security operations and engineering, defining roles, decision rights, governance and accountability across internal teams and service partners.
• Advise executives on threats, incidents, control gaps, maturity, strategic tradeoffs and investments, explaining technical issues in business terms.
• Influence GRC, Audit, IT, Architecture and business leaders to adopt enterprise standards, resolve complex cross-functional risks and advance cybersecurity priorities without relying on direct authority.

Requirements

• A bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering or a related field. Equivalent industry experience, military service, professional certifications and proven leadership experience are all weighed equally.
• 10+ years of progressive cybersecurity experience, with substantial depth in security operations, detection engineering, incident response or security engineering.
• 7+ years leading complex security operations, engineering, SOC or incident response capabilities, teams or enterprise programs.
• Experience running security capabilities across cloud, SaaS, endpoint, identity and enterprise environments.
• Experience managing MSSP, MDR, SOC-as-a-Service or other strategic security service providers.
• Hands-on work with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar or Chronicle.
• Experience with Azure, AWS or GCP environments.
• Proven record of building enterprise security strategy, capability roadmaps, architecture, standards and operating models within a domain.
• Proven ability to solve novel, ambiguous and highly complex security problems with wide enterprise impact.
• Working knowledge of Zero Trust principles and modern detection strategy.
• Ability to advise executives, influence enterprise decisions and turn technical risk into business implications, strategic options and investment recommendations.
• Experience leading complex investigations and incident response across security, IT, Legal, Privacy, HR, Communications and executives, where operational, regulatory, financial or reputational stakes are high.
• Preferred: experience defining and running multiyear security capability roadmaps, target-state architectures and operating models.
• Preferred: experience building or transforming an enterprise SOC and security engineering capability in a global or multi-business environment.
• Preferred: experience supporting a global or multi-business-unit environment.
• Preferred: experience leading incident response for major cybersecurity events.
• Preferred: one or more of the following certifications: CISSP, CISM, CCSP, GIAC certifications (GCIH, GCIA, GCFA, GMON), Microsoft Security certifications, Splunk certifications, Microsoft Sentinel certifications, CrowdStrike certifications, AWS, Azure or GCP security certifications, LI-SC1, IND123.

Conditions

Work is fully onsite, 4 days per week, with no hybrid or remote option.

You must live within a reasonable commute of both Brea, CA and Irvine, CA, since the office moves from Brea to Irvine in approximately Q1 2028.

The base salary range is $182,900 to $223,600. This is a reasonable estimate and has not been adjusted for the geographic differential of the location where the role may be filled.

Pay depends on location, skills, education, certifications, experience, performance and business needs. Hiring at or near the top of the range is uncommon.

For field sales roles, the stated pay covers base salary only and excludes incentive pay under the sales plan.

Benefits

• An annual performance bonus may be part of the total package.
• Medical, dental and vision benefits.
• 401K match.
• Other compensation plans may apply.