The Director, Cyber Engineering and Operations is responsible for global threat detection and response, security engineering, and vulnerability management operations across the company's enterprise environment. This role leads a follow-the-sun incident response team spanning the US, EU, and Asia, and owns the operational relationship with the company's managed detection and response (MDR) provider. This role leads the Security Operations & Incident Response function within the Infrastructure, Operations, Architecture & Cyber Defense organization, executing the enterprise cyber defense strategy owned by that leader. As part of the IT leadership team, this role partners closely with Governance, Risk & Compliance, Identity & Access Management, Enterprise (Infrastructure/Cyber) Architecture, Platform Engineering, and Network teams to deliver a resilient, compliant security operations capability across a global, acquisitive manufacturing environment.
HOW YOU WILL MAKE AN IMPACT:
Define and execute the Security Operations & Incident Response strategy, roadmap, and staffing model. Lead a follow-the-sun Incident Response team covering detection, triage, and response across US, EU, and Asia regions. Own the relationship and SLA performance for the company's managed detection and response (MDR/EDR) provider. Mature the Security Operations Center (SOC) capability that provides detection and response coverage across the full estate — not only assets covered by the managed service — integrating and governing the MDR service for scale and surge and reducing reliance on it over time. Serve as operational incident commander for security incidents, escalating major incidents and executive communications to the Director, Infrastructure, Operations, Architecture & Cyber Defense in accordance with the incident response plan. Direct security engineering and detection engineering work, including tuning and content development across the security stack. Administer the vulnerability scanning toolset and lead remediation engineering, in partnership with GRC on policy and risk reporting and with functional IT teams on remediation execution. Coordinate incident response playbooks, tabletop exercises, and post-incident reviews. Partner with Identity & Access Management, Platform Engineering, and Network teams to align security architecture and controls across the environment. Partner with the Enterprise (Infrastructure/Cyber) Architect to ensure security requirements and controls are designed into platforms, transitions, and provider operations on a secure-by-design basis. Coordinate handoff protocols with third-party MSSPs supporting regulated enclaves (e.g., CMMC).Deliver regular security operations metrics, incident reporting, and program status to IT leadership. Contribute security operations metrics and maturity evidence to Enterprise Risk Management, the enterprise cybersecurity maturity roadmap (NIST CSF) and to board-level cyber reporting. Provide security operations input to M&A cyber due diligence and the rapid onboarding of acquisitions into monitoring and response coverage. Support audit readiness and evidence collection for relevant regulatory frameworks (ITAR, CMMC, NIST 800-171).WHAT YOU WILL BRING TO THE ROLE:BS in Computer Science, Information Systems, or related field; equivalent experience considered.10+ years in cybersecurity, including 5+ years leading a security operations or incident response function. Experience managing a globally distributed security team, ideally in a follow-the-sun model. Hands-on experience with EDR/XDR platforms and managed detection service providers (CrowdStrike experience a plus).Familiarity with vulnerability scanning tools and remediation workflows. Experience managing external vendors and MSSPs against defined SLAs. Exposure to regulated environments (ITAR, CMMC, NIST 800-171) is a plus.
Certifications:
(Preferred): CISSP, GIAC (GCIH, GCIA, or similar), CISM.Strong communication skills and comfort reporting to IT and executive leadership. Experience building or maturing a security operations and incident response function from an early or under-developed state. Working familiarity with identity and access management (IAM/PAM) and network security concepts, sufficient to partner effectively with those peer functions. Demonstrated ability and willingness to use AI tools to improve productivity, decision-making, work quality, and to reduce costs. The successful candidate must be able to identify appropriate AI use cases and critically evaluate AI-generated outputs.#LI-BM1
