Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

Job Description:

JOB SUMMARY:

Must reside within a commutable distance to both Brea, CA and Irvine, CA, as the office location will be relocated from Brea to Irvine in approximately Q1 2028. This is not a hybrid or remote opportunity and requires onsite presence 4 days per week.

We are seeking a strategic and hands-on Security Operations and Engineering Lead to serve as Envista’s senior technical expert for security operations, detection engineering, incident response, and security platform capabilities. Operating with a high degree of autonomy, this role translates the Global Head of Information Security & GRC’s direction into scalable capabilities, operating models, roadmaps, and measurable outcomes.

This leader provides domain leadership for the SOC, incident response program, detection lifecycle, and security tooling ecosystem and is responsible for building scalable, threat-informed, and measurable security operations. The role shapes direction within the Security Operations & Engineering domain, recommends priorities and investments, and influences enterprise decisions through technical expertise, while final accountability for Envista’s overall cybersecurity strategy remains with the Global Head of Information Security & GRC.

PRIMARY DUTIES AND RESPONSIBILITIES:

Security Operations Leadership

• Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.
• Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes.
• Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and the cybersecurity strategy established by the Global Head of Information Security & GRC.
• Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness.
• Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap for approval by the Global Head of Information Security & GRC.

Security Engineering & Platform Management

• Develop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms.
• Drive automation across triage, enrichment, containment, and reporting workflows.
• Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities across the enterprise.
• Define enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standards.
• Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement based on enterprise risk, business value, and alignment with cybersecurity priorities.

Incident Response & Threat Management

• Provide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications, within the governance and escalation framework established by the Global Head of Information Security & GRC.
• Serve as the senior operational and technical lead for major incidents, directing containment, eradication, recovery, and root cause analysis and advising executive leadership on response options and business implications.
• Ensure post-incident reviews drive durable control improvements
• Develop response strategies for novel or unprecedented cybersecurity events where established playbooks are insufficient.
• Coordinate with Legal, Privacy, HR, IT, and Communications

Detection Engineering & Monitoring

• Build detection engineering lifecycle: hypothesis → development → testing → tuning → deployment → validation → retirement.
• Develop behavior-based and threat-informed detections aligned to MITRE ATT&CK.
• Expand monitoring across endpoint, identity, cloud, SaaS, network, and critical applications.
• Anticipate emerging detection gaps and develop innovative, threat-informed solutions using red team, penetration testing, vulnerability, incident, and external threat intelligence.

Exposure & Control Operations

• Shape and advance exposure management, asset inventory visibility, and attack surface monitoring capabilities across the enterprise.
• Drive continuous control monitoring and validation of key security controls.
• Improve vulnerability remediation workflows and risk reduction outcomes.
• Drive measurable improvements in enterprise cyber resilience, operational continuity, and material-risk reduction across business units and technology environments.

Leadership & Stakeholder Management

• Build and lead high-performing security operations and engineering teams and strategic partners, while serving as the senior technical leader for the domain.
• Design and implement the Security Operations & Engineering operating model, defining roles, decision rights, governance, and accountability across internal teams and service partners.
• Advise executive leadership on threats, incidents, control gaps, maturity, strategic tradeoffs, and recommended investments, translating complex technical issues into clear business implications.
• Influence GRC, Audit, IT, Architecture, and business leaders to align on enterprise standards, resolve complex cross-functional risks, and advance cybersecurity priorities without relying solely on direct authority.

Job Requirements:

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering, or a related field
• Equivalent industry experience, military service, professional certifications, and demonstrated leadership experience are valued equally
• 10+ years of progressive cybersecurity experience, including substantial depth in security operations, detection engineering, incident response, or security engineering
• 7+ years leading complex security operations, engineering, SOC, or incident response capabilities, teams, or enterprise programs
• Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.
• Experience managing MSSP, MDR, SOC-as-a-Service, or strategic security service providers.
• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle, etc.)
• Experience in Azure, AWS, or GCP environments.
• Demonstrated experience developing enterprise security strategy, capability roadmaps, architecture, standards, and operating models within an assigned domain.
• Demonstrated ability to solve novel, ambiguous, and highly complex security problems with broad enterprise impact.
• Understanding of Zero Trust security principles and modern detection strategies.
• Demonstrated ability to advise executive leadership, influence enterprise decisions, and translate complex technical risks into business implications, strategic options, and investment recommendations.
• Experience leading highly complex investigations and incident response across security, IT, Legal, Privacy, HR, Communications, and executive stakeholders in situations with significant operational, regulatory, financial, or reputational implications.

PREFERRED SKILLS & EXPERIENCE:

• Experience defining and executing multiyear security capability roadmaps, target-state architectures, and operating models.
• Experience building or transforming an enterprise SOC and security engineering capability in a global or multi-business environment.
• Experience supporting a global or multi-business-unit environment.
• Experience leading incident response for major cybersecurity events
• One or more of the following certifications:
  • CISSP; CISM; CCSP
  • GIAC certifications (GCIH, GCIA, GCFA, GMON)
  • Microsoft Security certifications
  • Splunk certifications
  • Microsoft Sentinel certifications
  • CrowdStrike certifications
  • AWS/Azure/GCP security certifications

#LI-SC1

IND123

Target Market Salary Range:

Actual compensation packages take into account a wide range of factors that are unique to each candidate, including but not limited to geographic location; skill sets; relevant education and certifications; depth of experience; performance; and other business and organizational needs. The disclosed reasonable estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Envista, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. The total compensation package for this position may also include an annual performance bonus, medical/dental/vision benefits, 401K match, and/or other applicable compensation plans.

For Field Sales roles, the salary range listed reflects base pay only and does not include incentive pay opportunities under the applicable sales compensation plan

Operating Company:

Envista is a global leader in the dental industry, uniting more than 30 trusted brands—including DEXIS, Kerr, Nobel Biocare, and Ormco—under one mission: partnering with dental professionals to improve patients’ lives. With a heritage of category-defining innovation, our brands have shaped modern dentistry: Nobel Biocare introduced the first dental implant, Ormco is a pioneer in both traditional and digital orthodontics, DEXIS has long been at the forefront of 2D, 3D and intraoral imaging, and Kerr has supported clinicians for over 135 years. Our high-performing culture is underpinned by our CIRCLe Values and the Envista Business System. Guided by these, we deliver a comprehensive portfolio of technologies, consumables, and services that empower clinicians to provide confident, efficient care—today and for the future. Learn more at .

Envista and all Envista Companies are equal opportunity employers that evaluate qualified applicants without regard to race, color, national origin, religion, sex, age, marital status, disability, veteran status, sexual orientation, gender identity, or other characteristics protected by law. The “EEO is the Law” poster is available at: compliance/posters/pdf/eeopost.pdf.

Envista and its family of companies (Envista) will not accept unsolicited resumes from any source other than directly from a candidate. Envista will consider unsolicited referrals and/or resumes submitted by vendors such as search firms, staffing agencies, professional recruiters, fee-based referral services and recruiting agencies (Agency) to have been referred by the Agency free of charge and Envista will not pay a fee for any placement resulting from the receipt such unsolicited resumes. An Agency must obtain advance written approval from Envista's internal Talent Acquisition or Human Resources team to submit resumes, and then only in conjunction with a valid fully-executed contract approved by the Global Talent Acquisition leader and in response to a specific job opening. Envista will not pay a fee to any Agency that does not have such agreement and written approval in place.