Lead Director - Security Operations Center (SOC)

We're building a world of health around every individual , shaping a more connected, convenient and compassionate health experience.

The Lead Director - Security Operations Center (SOC) is responsible for leading the cybersecurity operations function for a rapidly evolving healthcare business, ensuring the organization can effectively detect, investigate, respond to, and recover from cybersecurity threats.

Security Operations Leadership

• Lead the strategy, execution, and continuous improvement of the Security Operations Center, including threat monitoring, detection, investigation, response, and threat hunting activities.
• Establish operational processes, service levels, metrics, and reporting to measure effectiveness and support informed decision-making.
• Build and mature SOC capabilities that align security operations to business priorities, risk tolerance, and growth objectives.
• Ensure operational readiness, escalation procedures, and effective coordination during cybersecurity events and incidents.

Threat Detection & Incident Response

• Serve as the primary escalation point for significant cyber incidents and coordinate response efforts across technical and business stakeholders.
• Drive improvements in detection engineering, investigation processes, and response workflows to reduce risk and improve response times.
• Leverage automation, analytics, and AI-enabled capabilities to improve operational efficiency and strengthen cyber defense outcomes.

Cybersecurity Strategy & Resilience

• Develop and maintain security operations standards, processes, and controls aligned with regulatory requirements and industry best practices.
• Lead initiatives that strengthen cyber resilience, incident preparedness, ransomware response readiness, and recovery capabilities.
• Provide leadership with visibility into threat activity, operational performance, emerging risks, and strategic recommendations.
• Support regulatory, audit, and risk management activities related to cybersecurity operations.

Cloud, Identity & Platform Security

• Lead security operations across cloud, endpoint, identity, and network environments.
• Drive the effective use and continuous optimization of security technologies supporting monitoring, detection, investigation, and response functions.
• Partner with cloud, infrastructure, identity, and engineering teams to improve security visibility, response capabilities, and overall security posture.
• Ensure appropriate monitoring and threat detection coverage across critical systems, applications, and business services.

Leadership & Talent Development

• Build, develop, and lead a high-performing team of security operations professionals.
• Foster a culture of accountability, collaboration, innovation, and continuous learning.
• Provide mentorship, coaching, and career development opportunities to strengthen team capability and succession depth.
• Align team priorities and resources to evolving business needs, threat landscapes, and organizational objectives.

Operational Excellence & Continuous Improvement

• Identify opportunities to improve efficiency through process optimization, automation, and standardization.
• Establish meaningful metrics and reporting that demonstrate operational performance, effectiveness, and risk reduction.
• Drive continuous improvement initiatives that enhance the maturity, scalability, and effectiveness of security operations capabilities.
• Collaborate with stakeholders across technology and business functions to ensure security operations remains aligned with organizational priorities.

Required Qualifications

• 10+ years of progressive cybersecurity experience within medium-large scale environments.
• 5+ years leading Security Operations Center (SOC), Incident Response, Cyber Defense, or Threat Detection teams.
• 5+ years of experience operating and optimizing enterprise security platforms, including SIEM, EDR/XDR, SOAR, and security automation technologies such as Microsoft Sentinel, CrowdStrike Falcon, and Wirespeed.
• 3+ years of demonstrated experience building, managing, and maturing security operations capabilities, including security monitoring, threat hunting, incident response, digital forensics, and security investigations.

Preferred Qualifications

• Experience supporting cloud-native and hybrid security operations across Microsoft Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS).
• Hands-on experience with Microsoft Security technologies, including Sentinel, Defender XDR, Defender for Cloud, and Entra ID, as well as Google Security Command Center.
• Experience implementing security automation, orchestration, AI-enabled security operations, or operational workflow optimization within a SOC environment.
• Strong knowledge of Zero Trust architecture, identity security, vulnerability management, cyber resilience, and ransomware response preparedness.
• Proven ability to lead teams, establish operational metrics, and communicate cybersecurity risks, incident impacts, and program performance to senior leadership.
• Industry certifications such as CISSP, CISM, CCSP, GIAC certifications, Microsoft Security certifications (SC-100, SC-200), Google Professional Cloud Security Engineer, or CrowdStrike Falcon Certification.

Education

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent experience.

Pay Range $144,200.00 - $288,400.00