Lead, Security Operations

At Genworth and CareScout, we’re on a mission to simplify and dignify the aging experience.

The truth is, most of us will help a parent, spouse, family member, friend, or neighbor navigate aging and care at some point in our lives.  We’ve been there ourselves.  That’s why we’re building better ways to help people find, fund, and understand aging care all while being supported every step of the way. 

We’re a team of curious problem-solvers, compassionate listeners, and people who care about making a difference.  We value diverse perspectives and are committed to fostering an inclusive culture where every team member feels respected, supported, and empowered to bring their authentic self.

Our four values guide our strategy, our decisions, and our interactions:

●       Make it human. We care about the people that make up our customers, colleagues, and communities.

●       Make it about others. We do what's best for our customers and collaborate to drive progress. 

●       Make it happen. We work with intention toward a common purpose and forge ways forward together. 

●       Make it better. We create fulfilling purpose-driven careers by learning from the world and each other.

If you’re looking to build a meaningful career while helping transform the aging experience for millions of families, we’d love to hear from you.

Lead, Security Operations

This position is available to Virginia residents as Richmond, VA hybrid in-office applicants or remote applicants residing in North Carolina, Maryland, Virginia, DC Metro.

As Lead, Security Operations at Genworth | CareScout, you will lead our Computer Security Incident Response Team (CSIRT) and coordinate broader cybersecurity incident response efforts across the enterprise. You will guide the team’s preparation and response—from planning, intelligence, and detection engineering to investigation and containment through recovery and lessons learned—to protect our information, minimize business disruption, and strengthen operational resilience.

• →Lead the Computer Security Incident Response Team (CSIRT), setting priorities, developing team capabilities, and establishing clear accountability for incident readiness and response.
• → Direct cybersecurity incident response from initial triage and investigation through containment, eradication, recovery, and post-incident review.
• → Coordinate broader incident response efforts across Cybersecurity, Technology, business teams, and external partners, ensuring clear ownership, timely escalation, and effective handoffs.
• →Maintain and enhance incident response plans, playbooks, severity criteria, and escalation procedures to support consistent execution.
• →Serve as a primary escalation point for significant cybersecurity incidents, translating technical findings into clear business impacts, response options, and leadership updates.
• →Partner with Legal, Privacy, Compliance, Risk, Communications, and Business Continuity teams to support incident decisions, notification assessments, and recovery coordination
• →Guide incident investigations, including evidence preservation, forensic analysis, and documentation, engaging specialized internal resources and external providers as needed.
• →Lead tabletop exercises and response simulations to test readiness, clarify responsibilities, and address gaps before incidents occur.
• →Use incident trends, threat intelligence, and lessons learned to strengthen detection and response capabilities, improve playbooks, and reduce recurring issues.
• →Establish response metrics and reporting, oversee incident response service providers, and drive improvements in response speed, quality, and operational resilience.
• →Leverage AI and automation to identify and respond to cybersecurity threats at machine speed

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or 7+ years of equivalent relevant experience.
• Significant progressive experience in cybersecurity operations and incident response, including leadership of a CSIRT or comparable response function.
• Demonstrated experience directing complex cybersecurity incidents and coordinating response across technical teams, business stakeholders, and external partners.
• Strong technical knowledge of incident investigation, containment, eradication, and recovery across endpoint, network, identity, and cloud environments.
• Experience with security monitoring and investigation technologies, including security information and event management (SIEM), endpoint detection and response (EDR), and security orchestration and automation tools.
• Working knowledge of digital forensics, evidence handling, threat intelligence, and attacker tactics, techniques, and procedures.
• Experience developing incident response plans, playbooks, escalation frameworks, readiness exercises, and performance measures.
• Ability to lead and develop technical professionals, establish operational discipline, and maintain clear accountability during high-pressure situations.
• Strong judgment and communication skills, with the ability to explain technical issues, business impacts, and response decisions to senior leaders and nontechnical audiences.
• Experience in a regulated environment, preferably financial services or insurance, including partnership with Legal, Privacy, Risk, and Compliance on incident-related requirements.
• Ability to support incident escalations outside normal business hours.
• Relevant certifications such as CISSP, GCIH, GCFA, or comparable incident response credentials preferred.    

• This role is not eligible for employment visa sponsorship.