Director of Security Operations

Overview The Director of Security Operations leads the team responsible for detection and response across the enterprise. This role owns incident response, endpoint detection and response, email security, and SIEM and detection engineering, along with the monitoring and automation that support them. The director sets the strategy, staffing model, budget, and operating metrics for the function, and remains a working leader who takes incident commander duty, builds detections, and reviews analyst work alongside the team. Responsibilities Own the detection and response strategy and multi year roadmap, and align it to enterprise risk, the threat landscape, and business priorities Lead, coach, and develop the security operations team, including hiring, scheduling, on call rotation, performance management, succession planning, and career development Operate as a player coach, taking incident commander duty, writing detections, and performing hands on analysis alongside the team Own the incident response program end to end, including the IR plan, severity model, escalation paths, tabletop exercises, evidence handling, and post incident review Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting Own email security, including phishing defense, mail authentication controls (SPF, DKIM, DMARC), user reporting workflows, and response to business email compromise attempts Own SIEM and detection e