Sr Director, Cybersecurity Defense & Response (Hybrid - Dallas TX)

Description

You will run the daily work of the cyber incident response program, the global security operations center and the managed extended detection and response (MxDR) services. You answer for how quickly and well security threats and incidents are handled, for how internal and third-party security providers perform, and for detection driven by threat intelligence.

You will also set the direction for using AI in security operations, with clear governance and people checking its output.

The role covers both the long-term roadmap and sourcing model for cyber defense and the day-to-day running of the operation, including measurable service levels, detection engineering and automation. You are expected to be an expert in cyber forensics, industry practice and incident response process.

The team is based in Dallas, TX and works in a hybrid model.

Responsibilities

• Lead, grow and improve the people, processes and tools of a 24x7 global security operations center, covering both internal staff and managed service providers.
• Own the MxDR operating model: set requirements, select vendors, manage transitions and renewals, and hold providers to service levels, remedies and cost targets.
• Direct detection engineering across SIEM, SOAR and EDR, covering log source coverage, MITRE ATT&CK coverage and automation that shortens time to detect and respond.
• Define and lead the AI strategy for the SOC, including AI-assisted triage, investigation, detection engineering and automation, with guardrails, governance and human oversight. Measure results such as time to triage, time to respond and analyst workload.
• Evaluate and choose AI capabilities from technology and managed service providers, and hold them accountable for AI-driven service gains and cost.
• Lead threat-intelligence-driven operations: threat intelligence, proactive threat hunting, and digital risk and dark web monitoring.
• Build and run the Enterprise Incident Response Program so it keeps maturing.
• Work with groups such as Crisis Management and Business Continuity on wider security initiatives, assessments and resilience testing.
• Set up dashboards and metrics for incident response and SOC maturity, and report performance to leadership.
• Manage the operating budget and vendor spend, and prepare business cases for service and sourcing changes.
• Brief technical and executive audiences on cyber security, give status updates and advise them.
• Use the incident response program to run cyber tabletop exercises and educational sessions for stakeholders.
• Lead incident response investigations, coordinate the response and brief senior leaders, keeping information confidential.

Requirements

• Bachelor's degree (BA or BS) and at least 14 years of relevant experience, or equivalent experience and/or education, plus at least 6 years of leadership experience.
• Deep experience leading incident response in cloud, virtualized and on-premises environments.
• Extensive hands-on experience handling complex cyber incidents under heavy pressure.
• Experience with SIEM, SOAR and EDR platforms and detection engineering practices.
• Working knowledge of AI and machine learning in security operations, including large language model and agent-based tools, and their risks: accuracy, data privacy, prompt injection and auditability.
• Up-to-date understanding of current and emerging threats and countermeasures, built through relationships with threat teams and vendors, and experience directing a team that applies threat intelligence to reduce risk.
• Ability to prepare and present accurate, timely information on technical solutions, recommendations and conclusions to stakeholders.
• Strong crisis management skills and steady focus, with the ability to manage relationships and communication channels.
• Excellent written and verbal communication, able to explain complex technical issues briefly to both technical staff and executives.
• Strong leadership, able to build and grow a global security operations center and incident response program.
• Proven ability to run a service against set metrics and service levels, and to drive ongoing improvement and automation.
• Sound critical thinking and decision-making, able to explain and defend a complex decision.
• Self-driven and able to work independently within the scope of the role.
• US citizenship is required because of the nature of the position.
• Preferred: Proven skill in incident response areas including computer intrusion investigation and digital forensics in enterprise environments.
• Preferred: Strategic planning and commercial judgment, including sourcing strategy, vendor negotiation and financial management, with managed security service provider (MSSP) experience.
• Preferred: Experience in large, complex, global organizations.

Conditions

The role is hybrid, combining in-office work with virtual or remote work, and is based in Dallas, TX.

US citizenship is required.

Sponsorship for US work authorization is not available for this position, now or in the future.

All new hires must attend an in-person Day 1 onboarding at a company office as a condition of employment.

The company is an equal opportunity employer and keeps all applicant information confidential under EEO guidelines.

Benefits

• Benefits may include medical, dental, vision, life, AD&D and disability cover, paid time off, leaves of absence, voluntary benefits, perks, flexible work options, well-being resources, an employee assistance program, business travel insurance, service recognition awards, a retirement savings plan and an employee stock purchase plan, depending on employment status.
• The company offers training and development programs to build technical and leadership skills, and a respectful, collaborative workplace.