Executive Director - Cyber Defense Operations

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.

The Executive Director of Cyber Defense Operations is a senior cybersecurity leader accountable for defining and executing the enterprise-wide strategy, operating model, and capabilities for cyber detection, response, and incident management. This leader provides strategic and operational oversight of the Security Operations Center (SOC) and Computer Security Incident Response Team (CSIRT), ensuring the organization is positioned to rapidly identify, contain, and remediate cyber threats while continuously advancing the maturity and effectiveness of its cyber defense capabilities.

The Executive Director provides decisive leadership during significant cyber events, setting priorities, mobilizing business and technology organizations, while translating rapidly evolving threats into clear business, operational, and regulatory implications. This leader establishes a long-term vision for cyber defense operations.  Integrating threat intelligence, threat hunting, advanced analytics, automation, and orchestration to strengthen detection and response capabilities at enterprise scale.

As a senior strategic leader within Cyber Defense, the Executive Director builds trusted partnerships with business, technology, legal, compliance, and security leaders across the enterprise.  They will ensure cyber defense capabilities and investments remain aligned with business priorities, regulatory requirements, and the modern threat landscape. The Executive Director also advances the strategic use of AI, automation, and emerging autonomous capabilities to improve the speed, precision, and scalability of Cyber Defense.

Through the development of high-performing global teams and senior cybersecurity leaders, the Executive Director builds the talent and capabilities required to meet both current and emerging threats. This leader also delivers executive-level insights, metrics, and strategic guidance that enable informed decision-making and strengthen organizational resilience.

Key Responsibilities: 

 Leadership & Strategy 

• Develop, maintain and execute the enterprise-wide detection and response program aligned with Cyber Defense, larger business objectives, and regulatory requirements. 

• Develop, own and maintain the enterprise Detection and Response Maturity Model, Strategy, Roadmap and Operating Model. 

• Lead and mentor a team of Triage, Detection Engineers, Threat Hunters, and Incident Response professionals, fostering a culture of continuous improvement and operational excellence. 

• Strategize with senior leaders across Product, Engineering, and Security. You are a key stakeholder in the company's direction, advocating for the telemetry and architectural changes required to support future detection use cases. 

Operational Management 

• Serve as the Incident Commander for major security incidents, coordinating technical teams and executive leadership 

• Develop innovative and cutting-edge detection content aligned with ATT&CK, ATLAS, D3FEND and various other cyber security frameworks 

• Identify and surface patterns to leadership regarding root causes of problems. You anticipate future challenges and own the delivery of solutions before they become bottlenecks. 

• Ensure tracking of OKRs aligned to maturity models, defining, tracking and reporting on KPIs and KRIs to track operational and strategic improvements 

Collaboration & Communication 

• Partner with threat intelligence, other security teams to enhance detection and response capabilities. 

• Act as a liaison with legal, compliance, and public relations during high-impact incidents. 

• Provide executive-level briefings and actionable insights to senior leadership. 

Continuous Improvement 

• Drive automation and orchestration initiatives to improve operational efficiency. 

• Monitor emerging threats and adapt operations, tactics, and strategies accordingly. 

• Lead tabletop exercises and other simulations to validate readiness. 

• 15+ years of experience in a technical cybersecurity function.
• 8+ years in a leadership role managing global detection and response, threat hunting, or security operations teams. 
• 5+ years of experience developing and executing a long-term strategic vision for security operations at an enterprise scale. 
• 5+ years of experience leveraging automation and orchestration (i.e., SOAR) to improve the efficiency and effectiveness of a security operations center (SOC). 
• 2+ years of experience with the application of AI and Machine Learning (AI/ML) on security data for anomaly detection, threat modeling, and predictive security.  

• Experience managing a globally distributed 24/7 security operations team. 

• Experience defining and driving a multiyear strategy for threat detection and response
• Strong understanding of security frameworks, risk management, and incident response 

• Deep understanding of people, process, technologies of successful cybersecurity program 

• Strong leadership and people management skills 

• Strong project management and time management skills 

• Proficient in analyzing operational data and creating visualizations and reports 

• Strong communicator, verbal and written, with presenter skills
• Relevant industry certifications like GAIC and CSIRT.

• Bachelor’s degree or equivalent experience (High School Diploma and 4 years relevant experience)

The typical pay range for this role is: