VP, Cyber Defense & Security Operations

VP, Cyber Defense & Security Operations - Hybrid in Charlotte, NC*

Optomi, in partnership with a national client in the speciality insurance space, is seeking a highly technical Vice President of Cyber Operations to lead and continue maturing a growing enterprise Cyber Defense organization.

This is not a traditional executive role where the leader operates several layers removed from the technology. The organization is intentionally lean today, and this individual will initially spend approximately 75% of their time in technical and operational leadership and 25% on strategy .

The ideal candidate is a working cybersecurity leader who can set direction, manage people and partners, and communicate with executives—but can also get directly involved in investigations, alerts, detections, tooling, integrations, and operational challenges when needed.

A major priority for this role will be the continued adoption of AI and automation within Security Operations , including integrating Microsoft Copilot and other AI capabilities into everyday Cyber Defense workflows.

What You'll Own

The VP of Cyber Operations will oversee several core Cyber Defense capabilities, including:

• Incident Response
• Threat Intelligence
• Threat Hunting and Threat Management
• Detection Engineering
• Managed SIEM operations
• Digital Forensics
• Security Operations and alert escalation
• AI and automation enablement within Cyber Defense
• MSSP oversight and operating-model optimization

The role will initially lead a lean internal Cyber Operations team consisting of approximately six professionals , including a team lead and five individual contributors, with the opportunity to grow the organization and leverage additional contractors and external resources over time.

Key Responsibilities

• Lead the organization's Cyber Operations and Cyber Defense capabilities while remaining actively involved in day-to-day technical operations.
• Own and mature enterprise Incident Response , including escalations, major incident coordination, investigation processes, and response preparedness.
• Lead Threat Intelligence, Threat Hunting, Detection Engineering, and Threat Management capabilities.
• Help operationalize a recently implemented Threat Intelligence Platform and improve how intelligence is integrated into broader security and vulnerability-management processes.
• Oversee the relationship with the organization's MSSP , which currently provides Tier 1 and Tier 2 monitoring and triage.
• Ensure higher-tier escalations, custom detections, and complex security events are effectively investigated and handled by the internal team.
• Evaluate opportunities to automate triage, enrichment, investigation, and response workflows.
• Drive the practical implementation of AI within Cyber Operations , particularly Microsoft Copilot and related AI-enabled security capabilities.
• Identify opportunities to reduce analyst workload and improve response speed through AI, automation, orchestration, and integrations.
• Lead and continuously improve the Cyber Operations strategy, adjusting priorities and operating models as the threat landscape and organization evolve.
• Develop and execute cybersecurity tabletop exercises and incident-response preparedness activities.
• Build, mentor, and develop the existing Cyber Operations team while helping define the organization's future staffing and operating model.
• Partner with security engineering, vulnerability management, cloud, infrastructure, risk, and other technology teams.
• Provide leadership and technical guidance during significant cybersecurity incidents.
• Establish meaningful operational metrics and communicate Cyber Operations effectiveness, risk, and priorities to senior leadership.

Technical Environment

This organization is heavily invested in the Microsoft security ecosystem . Candidates should have strong familiarity with Microsoft security technologies and be able to understand and challenge what technical teams are seeing within the environment, including technologies such as:

• Microsoft Defender for Endpoint
• Microsoft Defender for Cloud
• Microsoft Purview
• Microsoft security and detection capabilities
• Microsoft Copilot / Security Copilot or related AI capabilities
• SIEM, detection, investigation, and response technologies

The successful candidate does not need to be the primary administrator for every platform but should possess enough technical depth to understand alerts, detections, investigations, configurations, integrations, and response decisions.

What We're Looking For

• Significant experience leading Security Operations, Cyber Defense, Incident Response, or Threat Management functions within a complex enterprise environment.
• Strong hands-on understanding of Incident Response, threat intelligence, threat hunting, detection engineering, SIEM, and digital forensics .
• Demonstrated experience managing an MSSP or outsourced SOC model while maintaining internal ownership of complex investigations and escalations.
• Strong knowledge of the Microsoft security ecosystem , particularly Defender technologies and adjacent Microsoft security tooling.
• Experience designing, implementing, or significantly improving security automation.
• Ability to operate as both an executive leader and technically credible practitioner.
• Experience building or maturing cybersecurity teams, operating models, processes, and capabilities.
• Strong executive communication skills with the ability to translate technical cybersecurity issues into business risk and priorities.
• Ability and willingness to remain close to the technology and personally engage when complex situations require it.

AI enablement will be one of the most important priorities for this position.

We are particularly interested in candidates who have gone beyond discussing AI conceptually and have actually implemented AI, automation, or advanced analytics within cybersecurity operations .

Relevant experience could include:

• AI-assisted alert triage
• Automated investigation and enrichment
• Copilot implementation within Security Operations
• Analyst workflow automation
• Detection or threat-intelligence enrichment
• AI-assisted incident investigation
• Security orchestration and response automation
• Integration of AI capabilities into existing security platforms and processes

Candidates do not need to have implemented every one of these capabilities, but they should have a strong point of view on how AI can practically improve modern Security Operations.

Leadership Opportunity

As the organization expands, this VP is expected to gradually shift from highly technical day-to-day involvement toward greater ownership of strategy, operations, team development, Cyber Defense maturity, and long-term capability development .

The right candidate will be equally comfortable helping solve today's technical challenges and building the Cyber Operations organization the company will need several years from now.

*Will also consider candidates local or willing to relocate to Dallas, TX as well. Reocation offered for both locations up to $10K.