Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

Security Operations And Engineering LeadMust reside within a commutable distance to both Brea, CA and Irvine, CA, as the office location will be relocated from Brea to Irvine in approximately Q1 2028. This is not a hybrid or remote opportunity and requires onsite presence 4 days per week.We are seeking a strategic and hands-on Security Operations and Engineering Lead to serve as Envista's senior technical expert for security operations, detection engineering, incident response, and security platform capabilities. Operating with a high degree of autonomy, this role translates the Global Head of Information Security & GRC's direction into scalable capabilities, operating models, roadmaps, and measurable outcomes.This leader provides domain leadership for the SOC, incident response program, detection lifecycle, and security tooling ecosystem and is responsible for building scalable, threat-informed, and measurable security operations. The role shapes direction within the Security Operations & Engineering domain, recommends priorities and investments, and influences enterprise decisions through technical expertise, while final accountability for Envista's overall cybersecurity strategy remains with the Global Head of Information Security & GRC.Primary Duties And ResponsibilitiesSecurity Operations LeadershipLead enterprise security operations including monitoring, triage, investigation, escalation, and response.Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes.Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and the cybersecurity strategy established by the Global Head of Information Security & GRC.Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness.Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap for approval by the Global Head of Information Security & GRC.Security Engineering & Platform ManagementDevelop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms.Drive automation across triage, enrichment, containment, and reporting workflows.Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities across the enterprise.Define enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standards.Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement based on enterprise risk, business value, and alignment with cybersecurity priorities.Incident Response & Threat ManagementProvide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications, within the governance and escalation framework established by the Global Head of Information Security & GRC.Serve as the senior operational and technical lead for major incidents, directing containment, eradication, recovery, and root cause analysis and advising executive leadership on response options and business implications.Ensure post-incident reviews drive durable control improvementsDevelop response strategies for novel or unprecedented cybersecurity events where established playbooks are insufficient.Coordinate with Legal, Privacy, HR, IT, and CommunicationsDetection Engineering & MonitoringBuild detection engineering lifecycle: hypothesis ? development ? testing ? tuning ? deployment ? validation ? retirement.Develop behavior-based and threat-informed detections aligned to MITRE ATT&CK.Expand monitoring across endpoint, identity, cloud, SaaS, network, and critical applications.Anticipate emerging detection gaps and develop innovative, threat-informed solutions using red team, penetration testing, vulnerability, incident, and external threat intelligence.Exposure & Control OperationsShape and advance exposure management, asset inventory visibility, and attack surface monitoring capabilities across the enterprise.Drive continuous control monitoring and validation of key security controls.Improve vulnerability remediation workflows and risk reduction outcomes.Drive measurable improvements in enterprise cyber resilience, operational continuity, and material-risk reduction across business units and technology environments.Leadership & Stakeholder ManagementBuild and lead high-performing security operations and engineering teams and strategic partners, while serving as the senior technical leader for the domain.Design and implement the Security Operations & Engineering operating model, defining roles, decision rights, governance, and accountability across internal teams and service partners.Advise executive leadership on threats, incidents, control gaps, maturity, strategic tradeoffs, and recommended investments, translating complex technical issues into clear business implications.Influence GRC, Audit, IT, Architecture, and business leaders to align on enterprise standards, resolve complex cross-functional risks, and advance cybersecurity priorities without relying solely on direct authority.Job RequirementsBachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering, or a related fieldEquivalent industry experience, military service, professional certifications, and demonstrated leadership experience are valued equally10+ years of progressive cybersecurity experience, including substantial depth in security operations, detection engineering, incident response, or security engineering7+ years leading complex security operations, engineering, SOC, or incident response capabilities, teams, or enterprise programsExperience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.Experience managing MSSP, MDR, SOC-as-a-Service, or strategic security service providers.Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle, etc.)Experience in Azure, AWS, or GCP environments.Demonstrated experience developing enterprise security strategy, capability roadmaps, architecture, standards, and operating models within an assigned domain.Demonstrated ability to solve novel, ambiguous, and highly complex security problems with broad enterprise impact.Understanding of Zero Trust security principles and modern detection strategies.Demonstrated ability to advise executive leadership, influence enterprise decisions, and translate complex technical risks into business implications, strategic options, and investment recommendations.Experience leading highly complex investigations and incident response across security, IT, Legal, Privacy, HR, Communications, and executive stakeholders in situations with significant operational, regulatory, financial, or reputational implications.Preferred Skills & ExperienceExperience defining and executing multiyear security capability roadmaps, target-state architectures, and operating models.Experience building or transforming an enterprise SOC and security engineering capability in a global or multi-business environment.Experience supporting a global or multi-business-unit environment.Experience leading incident response for major cybersecurity eventsOne or more of the following certifications:CISSP; CISM; CCSPGIAC certifications (GCIH, GCIA, GCFA, GMON)Microsoft Security certificationsSplunk certificationsMicrosoft Sentinel certificationsCrowdStrike certificationsAWS/Azure/GCP security certificationsTarget Market Salary Range:Actual compensation packages take into account a wide range of factors that are unique to each candidate, including but not limited to geographic location; skill sets; relevant education and certifications; depth of experience; performance; and other business and organizational needs. The disclosed reasonable estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Envista, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. The total compensation package for this position may also include an annual performance bonus, medical/dental/vision benefits, 401K match, and/or other applicable compensation plans.For Field Sales roles, the salary range listed reflects base pay only and does not include incentive pay opportunities under the applicable sales compensation plan.$182,900 - $223,600Operating Company:Corporate