Director of Cybersecurity Operations

Job description

**Company Information** For more than 20 years, AEG has played a pivotal role in transforming sports and live entertainment. Annually, we host more than 160 million guests, promote more than 10,000 shows and present more than 22,000 events around the world. We are committed to innovation, artistry, and community, and leverage the power of our 300+ venues, leading sports franchises, marquee music brands, integrated entertainment districts, premier ticketing platform and global sponsorship activations, to create memorable moments that give the world reason to cheer. Our business is interwoven with the human mind and heart, and we strive to build a diverse and inclusive company that reflects the artists, athletes, and fans that we host; reach beyond traditional boundaries to support the communities in which we operate; and minimize our impact on the environment by adopting sustainable practices throughout our business operations. If you want to be challenged to up your game and make a difference, then join us in giving the world reason to cheer! **Job Summary** The Director of Cybersecurity Operations leads the organization's global cyber operations strategy, strengthening operational resilience and maturing enterprise defense capabilities across corporate, cloud, venue, and operational technology environments. Reporting to the Chief Information Security Officer (CISO), this role provides strategic and operational leadership for Security Operations, Threat Detection and Response, Vulnerability Management, Identity and Access Management (IAM), Data Loss Prevention (DLP), Penetration Testing, and Cyber Fusion Center operations. This leader designs, builds, optimizes, and continuously evolves scalable cybersecurity operations—including Global Security Operations Centers (GSOC), advanced detection/response programs, security automation and orchestration, threat intelligence, and globally distributed cyber operations—bringing deep technical expertise, operational leadership, and strategic vision to proactively defend against evolving threats while enabling business growth and technology transformation. The Director partners closely with Information Security Engineering, Infrastructure, Compliance, Legal, HR, and business leaders to strengthen security posture, reduce operational risk, and align initiatives with organizational objectives and regulatory requirements, while developing and communicating meaningful cybersecurity metrics, KPIs, and Key Risk Indicators (KRIs) through executive reporting and briefings on cyber risk, operational maturity, incident trends, and resilience initiatives to support informed decision-making. Success requires building and maturing high-performing programs, leading through complex and fast-changing threat landscapes, communicating effectively with technical and executive stakeholders, and translating cyber risk into actionable, business-focused strategies and outcomes. **Essential Functions** - Security Operations & Cyber Fusion Center Leadership: - Lead the strategy, design, and optimization of Global Security Operations Center (GSOC) and Cyber Fusion Center capabilities. - Lead threat detection, monitoring, threat hunting, incident triage, and response operations across enterprise, cloud, venue, and operational technology environments. - Develop detection engineering capabilities, operational playbooks, escalation procedures, and automation workflows to improve response effectiveness. - Oversee implementation and optimization of cybersecurity technologies including SIEM, SOAR, EDR/XDR, threat intelligence, and security analytics platforms. - Manage relationships with security vendors and coordinate globally distributed cyber operations activities. - Continuously assess and improve operational maturity aligned to industry frameworks, emerging threats, and business priorities. - Incident Response & Operational Resilience: - Lead enterprise incident response operations, ensuring rapid identification, containment, eradication, recovery, and post-incident remediation activities. - Direct the development, testing, and continuous improvement of incident response plans, operational playbooks, tabletop exercises, and cyber crisis simulations. - Coordinate cross-functional response efforts involving Infrastructure, Legal, HR, Compliance, Privacy, and business stakeholders during cybersecurity incidents. - Conduct post-incident reviews and drive lessons learned initiatives to improve operational resilience and reduce future risk exposure. - Support cyber resilience, business continuity, and disaster recovery initiatives related to cybersecurity operations. - Continuous Threat Exposure Management (CTEM) & Vulnerability Management: - Lead AEG’s Continuous Threat Exposure Management (CTEM) and enterprise vulnerability management programs across cloud, network, endpoint, application, identity, and operational technology environments. - Lead identification, prioritization, validation, and remediation of cyber exposures based on threat intelligence, exploitability, and business risk. - Drive exposure reduction initiatives leveraging threat intelligence, attack surface management, identity security, and security validation activities. - Partner with Infrastructure, Engineering, Application Development, Cloud Operations, and Compliance teams to coordinate timely remediation and risk reduction initiatives. - Support identity and access governance initiatives including privileged access management, least-privilege controls, multi-factor authentication, and identity-related risk reduction strategies. - Oversee vulnerability scanning, attack surface visibility, remediation governance, exposure tracking, and executive-level reporting processes. - Develop operational metrics, KPIs, and KRIs to measure exposure reduction effectiveness, remediation performance, and overall cyber risk posture. - Enhance CTEM processes, tooling, automation, and reporting capabilities aligned with evolving threats and business priorities. - Data Protection & Data Loss Prevention (DLP): - Lead enterprise Data Loss Prevention (DLP) strategies and data protection initiatives to safeguard sensitive corporate, customer, financial, and regulated data. - Oversee implementation and monitoring of controls designed to prevent unauthorized access, misuse, disclosure, or exfiltration of sensitive information. - Conduct regular assessments, audits, and effectiveness reviews of DLP controls and data protection capabilities. - Partner with Legal, Privacy, Compliance, and business stakeholders to align data protection initiatives with regulatory and organizational requirements. - Penetration Testing & Security Validation: - Direct internal and external penetration testing initiatives, red team exercises, and security validation assessments. - Coordinate remediation activities and track resolution of identified vulnerabilities and security gaps. - Evaluate effectiveness of security controls through continuous testing and adversary simulation activities. - Provide strategic recommendations for security architecture and operational improvements based on assessment findings. - Cybersecurity Strategy, Metrics & Executive Reporting: - Partner with the CISO and senior leadership to define and execute the cybersecurity operations strategy, roadmap, and maturity initiatives. - Drive cyber risk reduction initiatives through CTEM, threat-informed defense, and operational maturity programs. - Develop and communicate meaningful cybersecurity metrics, KPIs, and Key Risk Indicators (KRIs) to measure operational effectiveness, threat exposure, and program maturity. - Deliver executive-level reporting and briefings on cybersecurity posture, operational resilience, incident trends, emerging threats, and strategic initiatives.