# Lead Director - Security Operations Center (SOC) **Company**: CVS Health **Location**: New York, NY **Experience**: senior **Job type**: full-time **Salary**: $144,200.00 - $288,400.00 **Category**: Security **Industry**: Healthcare **Apply**: https://cvshealth.wd1.myworkdayjobs.com/en-US/CVS_Health_Careers/job/NY---New-York/Lead-Director---Security-Operations-Center--SOC-_R1029588?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/job/lead-director-security-operations-center-soc-d306bfb1-e02/ ## Description We're building a world of health around every individual , shaping a more connected, convenient and compassionate health experience. The Lead Director - Security Operations Center (SOC) is responsible for leading the cybersecurity operations function for a rapidly evolving healthcare business, ensuring the organization can effectively detect, investigate, respond to, and recover from cybersecurity threats. **Security Operations Leadership** - Lead the strategy, execution, and continuous improvement of the Security Operations Center, including threat monitoring, detection, investigation, response, and threat hunting activities. - Establish operational processes, service levels, metrics, and reporting to measure effectiveness and support informed decision-making. - Build and mature SOC capabilities that align security operations to business priorities, risk tolerance, and growth objectives. - Ensure operational readiness, escalation procedures, and effective coordination during cybersecurity events and incidents. **Threat Detection & Incident Response** - Serve as the primary escalation point for significant cyber incidents and coordinate response efforts across technical and business stakeholders. - Drive improvements in detection engineering, investigation processes, and response workflows to reduce risk and improve response times. - Leverage automation, analytics, and AI-enabled capabilities to improve operational efficiency and strengthen cyber defense outcomes. **Cybersecurity Strategy & Resilience** - Develop and maintain security operations standards, processes, and controls aligned with regulatory requirements and industry best practices. - Lead initiatives that strengthen cyber resilience, incident preparedness, ransomware response readiness, and recovery capabilities. - Provide leadership with visibility into threat activity, operational performance, emerging risks, and strategic recommendations. - Support regulatory, audit, and risk management activities related to cybersecurity operations. **Cloud, Identity & Platform Security** - Lead security operations across cloud, endpoint, identity, and network environments. - Drive the effective use and continuous optimization of security technologies supporting monitoring, detection, investigation, and response functions. - Partner with cloud, infrastructure, identity, and engineering teams to improve security visibility, response capabilities, and overall security posture. - Ensure appropriate monitoring and threat detection coverage across critical systems, applications, and business services. **Leadership & Talent Development** - Build, develop, and lead a high-performing team of security operations professionals. - Foster a culture of accountability, collaboration, innovation, and continuous learning. - Provide mentorship, coaching, and career development opportunities to strengthen team capability and succession depth. - Align team priorities and resources to evolving business needs, threat landscapes, and organizational objectives. **Operational Excellence & Continuous Improvement** - Identify opportunities to improve efficiency through process optimization, automation, and standardization. - Establish meaningful metrics and reporting that demonstrate operational performance, effectiveness, and risk reduction. - Drive continuous improvement initiatives that enhance the maturity, scalability, and effectiveness of security operations capabilities. - Collaborate with stakeholders across technology and business functions to ensure security operations remains aligned with organizational priorities. **Required Qualifications** - 10+ years of progressive cybersecurity experience within medium-large scale environments. - 5+ years leading Security Operations Center (SOC), Incident Response, Cyber Defense, or Threat Detection teams. - 5+ years of experience operating and optimizing enterprise security platforms, including SIEM, EDR/XDR, SOAR, and security automation technologies such as Microsoft Sentinel, CrowdStrike Falcon, and Wirespeed. - 3+ years of demonstrated experience building, managing, and maturing security operations capabilities, including security monitoring, threat hunting, incident response, digital forensics, and security investigations. **Preferred Qualifications** - Experience supporting cloud-native and hybrid security operations across Microsoft Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS). - Hands-on experience with Microsoft Security technologies, including Sentinel, Defender XDR, Defender for Cloud, and Entra ID, as well as Google Security Command Center. - Experience implementing security automation, orchestration, AI-enabled security operations, or operational workflow optimization within a SOC environment. - Strong knowledge of Zero Trust architecture, identity security, vulnerability management, cyber resilience, and ransomware response preparedness. - Proven ability to lead teams, establish operational metrics, and communicate cybersecurity risks, incident impacts, and program performance to senior leadership. - Industry certifications such as CISSP, CISM, CCSP, GIAC certifications, Microsoft Security certifications (SC-100, SC-200), Google Professional Cloud Security Engineer, or CrowdStrike Falcon Certification. **Education** - Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent experience. **Pay Range** $144,200.00 - $288,400.00 For more fresh new jobs, check out [yubhub.co](https://yubhub.co/). ## Skills ### Required - cybersecurity - security operations - threat detection - incident response - cloud security - identity security - SIEM - EDR/XDR - SOAR ### Nice to have - Microsoft Security - Google Security - Zero Trust architecture - ransomware response - CISSP - CISM - CCSP --- Source: [Apply at cvshealth.wd1.myworkdayjobs.com](https://cvshealth.wd1.myworkdayjobs.com/en-US/CVS_Health_Careers/job/NY---New-York/Lead-Director---Security-Operations-Center--SOC-_R1029588?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)