Senior Cybersecurity Operations and Defense Director

The position is described below. If you want to apply, click the Apply button at the top or bottom of this page. You'll be required to create an account or sign in to an existing one.

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Language Fluency:  English (Required)

Work Shift:

Please review the following job description:

Key Responsibilities

Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.

Strategy and Leadership

• Develop and execute the Security Operations and Threat Management strategy, roadmap and operating model, aligned with enterprise security strategy and business objectives.
• Lead, mentor and develop senior-level security leaders and cross-functional teams; build succession plans and a culture of accountability, learning and continuous improvement.
• Partner with executive leadership, Legal, IT, Privacy, Risk and business units to manage cyber risk and maintain business continuity.
• Establish operational metrics, risk indicators and reporting (e.g., MTTD, MTTR, coverage, SLA attainment) for executives and the Board.
• Develop budgets and multi-year resource plans, and demonstrate ROI from security operations, tooling and service investments.

Security Operations

• Direct MSP 24x7 Security Operations Center (SOC) operations, including monitoring, triage, detection engineering, SIEM/SOAR/XDR platforms and escalation processes.
• Define and maintain detection content, use cases and playbooks mapped to frameworks such as MITRE ATT&CK; measure and improve detection coverage and quality.
• Drive operational maturity through runbooks, quality assurance, tuning, automation and reduction of alert fatigue.
• Integrate threat intelligence feeds with vulnerability management operations
• Lead the threat intelligence, threat hunting and threat modeling functions to anticipate adversary behavior and prioritize defenses against relevant threat actors.
• Convert intelligence into actionable detections, hunts, control improvements and executive risk briefings.
• Run purple team and adversary emulation exercises with Red Team and Architecture partners to validate controls and detection efficacy.
• Participate in industry and government information-sharing communities to strengthen collective defense.

Incident Response

• Own the enterprise incident response program, including plans, playbooks, severity classification, communications protocols and on-call coverage.
• Serve as senior escalation point and incident commander for significant cyber incidents, coordinating technical, legal, communications, executive and regulatory response.
• Lead tabletop and crisis simulation exercises with executives and the Board; align with business continuity and disaster recovery programs.
• Ensure timely regulatory, customer and contractual notifications, and drive post-incident reviews that produce measurable corrective actions.

Digital Forensics

• Direct digital forensics and investigative capabilities across endpoint, network, cloud, identity and mobile environments, including malware analysis.
• Ensure evidence handling, chain of custody and documentation meet legal and regulatory standards; coordinate with Legal, HR, Compliance and law enforcement as needed.
• Support insider threat, fraud, eDiscovery and litigation matters under appropriate governance and privacy controls.
• Capture root cause and lessons learned to improve detection, prevention and response.

MSP Management

• Own the strategy, selection and governance of Managed Security Service Providers and other cyber operations vendors (e.g., managed detection and response, SOC augmentation, retainer-based IR and forensics).
• Define the sourcing model that balances internal and external capability, and negotiate contracts, SLAs, KPIs and exit and transition provisions.
• Hold providers accountable through regular service reviews, performance scorecards, quality audits and financial management.
• Ensure MSP integration with internal processes, tooling, data access and escalation paths, and manage third-party and concentration risk.

AI Operationalization

• Define and lead the strategy for applying AI and machine learning in cyber operations, including automated triage, enrichment, detection, response orchestration and investigation support.
• Move AI use cases from pilot to production with clear success criteria, human-in-the-loop controls, model performance monitoring and measurable operational benefit.
• Partner with Data, Engineering, Legal, Privacy and Risk teams to govern AI use, covering data quality, model risk, explainability, bias, and security of AI tools and pipelines.
• Prepare the organization to defend against AI-enabled threats and to secure enterprise AI systems, including prompt injection, data leakage and model abuse.
• Upskill staff on AI-augmented workflows, and track adoption, productivity and risk outcomes.
• Drive MSP AI usage and requirements to improve productive and reduce risk outcomes.

Governance and Compliance

• Ensure operations adhere to legal, regulatory and internal standards (e.g., NIST CSF, NIST 800-61, ISO 27001, SOC 2) and support audits and assessments.
• Contribute to security policies, standards and guidelines relevant to operations, and drive security awareness and adoption of best practices.

Education and Experience

The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science or a related field.
• Master's degree in Cybersecurity, Information Assurance, Business Administration or a related discipline preferred.
• 15+ years of experience in information security, cyber operations or IT risk management roles.
• 8+ years of experience in leadership roles directing enterprise security operations, including managing managers and large or distributed teams.
• Proven track record leading SOC, threat management, incident response and digital forensics functions in a complex enterprise.
• Demonstrated experience managing MSPs or MSSPs, including contract negotiation, SLA and performance governance, and budget accountability.
• Experience leading major incidents and executive or Board-level crisis communications.
• Experience introducing AI, machine learning or automation into security operations, moving use cases from pilot to production.
• Experience developing and implementing cybersecurity strategies, operating models and frameworks.

Certifications / Licenses / Registrations

• Certified Information Systems Security Professional (CISSP) preferred.
• Certified Information Security Manager (CISM) desirable.
• GIAC certifications in incident response, forensics or security operations (e.g., GCIH, GCFA, GCIA, GSOM) desirable.
• Certified Information Systems Auditor (CISA) or an equivalent risk, compliance or AI governance certification preferred.

Functional Skills

• Strategic thinking and vision setting for cyber operations and defense programs.
• Advanced knowledge of security operations, detection engineering, threat intelligence, incident response and digital forensics.
• Working knowledge of SIEM, SOAR, EDR/XDR, cloud security and identity-based attack and defense.
• Expertise in managed services and vendor governance, including SLA design, performance management and commercial negotiation.
• Practical understanding of AI and machine learning applications, limitations and risks in security operations, including AI governance and model risk concepts.
• Strong leadership and team development skills, with the ability to lead through crisis and build high-performing, diverse teams.
• Knowledge of regulatory and industry frameworks such as NIST CSF, NIST 800-61, MITRE ATT&CK, ISO 27001 and SOC standards, and of breach notification obligations.
• Ability to influence executives and communicate complex security concepts and risk effectively to technical and non-technical audiences.
• Proficiency in risk management, financial planning and business continuity planning.

General Description of Available Benefits for Eligible Employees of CRC Group: At CRC Group, we're committed to supporting every aspect of teammates' well-being – physical, emotional, financial, social, and professional. Our best-in-class benefits program is designed to care for the whole you, offering a wide range of coverage and support. Eligible full-time teammates enjoy access to medical, dental, vision, life, disability, and AD&D insurance; tax-advantaged savings accounts; and a 401(k) plan with company match. CRC Group also offers generous paid time off programs, including company holidays, vacation and sick days, new parent leave, and more. Eligible positions may also qualify for restricted stock units and/or a deferred compensation plan.

CRC Group supports a diverse workforce and is an Equal Opportunity Employer that does not discriminate against individuals on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status or other classification protected by law. CRC Group is a Drug Free Workplace.

EEO is the Law   Pay Transparency Nondiscrimination Provision   E-Verify