Director of Cybersecurity Operations

About the job

Job Title: Director Cybersecurity Operations

Engagement Type: Temp to Perm

Work Environment: Remote

Certifications: CISSP, Six Sigma, ITIL, GIAC, ECIH, EnCE

Alcor Solutions is seeking an experienced Cybersecurity Director of Operations who will report to the Sr. Director of Cybersecurity Services. This Director will play a key role in leading the cybersecurity organization in incident response, threat intelligence, identity and access/Vulnerability management operations. This leader will drive efficiency, effectiveness, and continuous improvement within the cybersecurity function along with design and optimize cybersecurity processes, implement metrics, and ensure we are identifying, mitigating, and responding to threats. They will collaborate across security, IT, and business teams to mature security operations, enhance risk management, and align cybersecurity with broader business objectives.

Strategy and Team Leadership

• Develop and implement a strategy for the Security Operations Center (SOC), Threat Intelligence, Threat Hunting, Incident Response, Crisis Management, Insider Risk, Digital Forensics, Exposure Management, and IAM Security Operations.
• Lead, coach, mentor, and develop a growing team of information security professionals.

Cyber Defense Leadership

• Provide technical leadership across cybersecurity incident management and the Security Operations Center (SOC), with a focus on enhancing incident handling processes, detection engineering, and threat mitigation capabilities.
• Oversee crisis response for cyber incidents, ensuring seamless planning, escalation, and resolution of major incidents to minimize business impact.
• Drive security capabilities by leveraging cloud-native tools and advancing automation for detection engineering and response.

Integrated Security Operations

• Oversee proactive Threat Intelligence and Threat Hunting efforts, ensuring effective integration of actionable intelligence into security processes.

Insider Risk and Forensics

• Build and manage an Insider Risk program to detect and mitigate internal threats.
• Lead Digital Forensics capabilities to support advanced investigations and evidence collection.

Vendor and Stakeholder Engagement

• Engage with external vendors to ensure product effectiveness and build partnerships that align with business objectives.
• Collaborate with internal teams to align security operations with organizational goals.
• Partner with legal and data protection officers to ensure consistent execution and measures for the laws and practices around data protection, globally.
• Partner and collaborate with international and diverse teams to ensure seamless day-to-day business operations, effective handovers, and foster a unified team culture.

Operational Maturity

• Develop clear documentation for processes, metrics, and outcomes, ensuring adherence to SLAs and compliance requirements.
• Foster continuous improvement across all cybersecurity functions.
• Stay current and share best practices with operating companies on how to use modern methods to address security gaps.
• Facilitate and monitor key performance metrics and reporting frameworks to ensure the efficiency and effectiveness of the program, facilitating resource allocation, and increasing the maturity of the security program.

Required Qualifications

• 10+ years of experience in cybersecurity, operations, or IT with a strong focus on operational excellence.
• Proven leadership experience in security operations, governance, or risk management.
• Strong background in process improvement methodologies (Lean, Six Sigma, ITIL, Agile).
• Experience with cybersecurity frameworks (NIST, ISO 27001, MITRE ATT&CK).
• Familiarity with security technologies (SIEM, SOAR, EDR, cloud security tools, vulnerability management).
• Excellent communication and leadership skills to drive alignment across security, IT, and business teams.

Preferred Qualifications

• Certifications: CISSP, CISM, CISA, ITIL, Lean Six Sigma, PMP.
• Experience in large-scale, complex organizations or highly regulated industries.
• Expertise with cybersecurity automation and analytics.

Key Skills and Competencies

Extensive experience in partnerships with Managed Service Providers; deep expertise in modern access operations methodologies with a passion for innovation and efficiency; demonstrated ability to identify gaps in current practices and architect solutions that become organizational standards; experience influencing without authority to drive adoption of best practices across diverse teams; strong foundation in IAM technologies with the agility to adapt to evolving platforms and tools; natural problem-solver who thrives on turning operational challenges into opportunities for improvement; outstanding communication skills with the ability to articulate complex concepts to both technical and business audiences; self-motivated individual who can work independently while fostering strong team collaboration; history of successfully implementing access operations frameworks in large companies.

Engagement Expectations

• Oversee the SOC, threat monitoring, detection, and response. Establish clear coverage, escalation procedures, and service expectations.
• Lead major cybersecurity incident coordination, communicate business impact, and ensure recovery and post-incident reviews are completed. Participate in critical escalations under an agreed on-call arrangement.
• Manage employees and service providers, clarify responsibilities, assess staffing needs, and develop team capabilities.
• Assess SIEM, EDR, SOAR, and related capabilities. Prioritize detection gaps, alert quality, automation, and tool effectiveness.
• Coordinate risk-based remediation with IT and business owners, track overdue critical exposures, and escalate unresolved risks.
• Provide concise updates on incidents, operational performance, coverage gaps, risks, and decisions requiring leadership attention.
• Work closely with IT, Engineering, GRC, Legal, Privacy, HR, and business leaders during routine operations and incident

Success Measures

• Delivers an approved improvement roadmap with priorities, owners, milestones, and resource needs.
• Delivers an approved improvement roadmap within 60 days, with priorities, owners, milestones, and resource needs.
• Identifies critical monitoring gaps and validates priority detections through testing or exercises.
• Reduces unnecessary alerts and aged investigation backlogs while maintaining detection effectiveness.
• Tracks critical log-source availability, tool health, and staffing coverage. Resolves or escalates material gaps promptly.
• Coordinates timely remediation of critical exposures with IT and business owners. Exceptions have documented approval and review dates.
• Tests escalation procedures and response playbooks. Assigns and tracks corrective actions from exercises and actual incidents.
• Establishes clear responsibilities, sustainable on-call coverage, development plans, and accountability for service provider performance.
• Communicates incident impact, operational trends, material risks, and decisions needed in clear business terms.