Director, Cyber Defense

The Director of Cyber Defense reports to the Chief Information Security Officer and operates within the Office of the CISO. This role owns the full cyber defense mission: threat detection, incident response, threat intelligence, threat hunting, and digital forensics. The Director is accountable for global IT security monitoring across this multi-entity, multi-tenant environment, ensuring consistent visibility, detection coverage, and response readiness regardless of where in the ecosystem a threat emerges. The ideal candidate pairs deep operational cyber defense expertise with a demonstrated record of building teams, transforming operating models, and applying security operations at scale.

Cyber defense leadership:  Own and mature the enterprise cyber defense function, spanning detection engineering, incident response, threat intelligence, threat hunting, and DFIR, setting strategy, standards, and operational metrics across the Ecosystem. Global monitoring across a diverse ecosystem:  Direct 24x7 global IT security monitoring across a multi-tenant environment serving a diverse ecosystem of companies, including regulated financial entities, ensuring consistent telemetry coverage, detection fidelity, and response SLAs for every entity. Agentic cyber defense:  Lead the organization in AI adoption by architecting and delivering an agentic cyber defense model, deploying AI agents for alert enrichment, triage, investigation, detection engineering, and automated response, with clearly defined human-in-the-loop controls, guardrails, and escalation paths. Secure AI:  Establish and enforce governance for AI used in cyber defense (model risk, data handling, auditability, and acceptable use), and defend the enterprise's AI estate, including AI gateways, model endpoints, agent frameworks, and AI-enabled SaaS, against emerging threats such as prompt injection, model abuse, and data exfiltration. Incident response:  Own the enterprise incident response framework and entity-specific playbooks; lead major incident command, coordinate cross-entity response, and drive post-incident reviews, root cause analysis, and control improvements. Detection and automation engineering:  Direct SIEM/SOAR strategy and engineering, driving AI/ML-enhanced detections, behavioral analytics, and intelligent automation to improve signal-to-noise ratio and reduce time to detect and respond. Threat intelligence and hunting:  Mature the threat intelligence program with PIR-driven collection and dissemination, and lead proactive, hypothesis-driven threat hunting across the ecosystem. Stakeholder engagement:  Partner with entity leadership, IT, engineering, legal, and compliance; represent cyber defense in architecture reviews and risk governance forums; report operational posture and metrics to executive leadership and boards. Team leadership:  Build, coach, and retain a high-performing cyber defense team; accurately assess performance, develop talent, and evolve roles as agentic capabilities reshape the operating model. Regulatory alignment:  Ensure monitoring and response capabilities satisfy regulatory obligations across the portfolio, including federally regulated banking entities, and support audits, examinations, and legal matters as required.

Bachelor’s degree in computer science, Information Security, or a related field; advanced degree a plus. 10+ years of progressive experience in cyber defense or security operations, including 5+ years leading teams, with direct accountability for detection, incident response, and threat intelligence functions. Demonstrated experience applying AI/ML and automation to security operations, and a credible vision for building agentic cyber defense capabilities with appropriate human oversight. Working knowledge of AI security and governance: securing LLM/agentic workloads, AI gateways, and model endpoints, and familiarity with frameworks such as the NIST AI RMF,