Executive Director - Cyber Defense Operations

Job description

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time. Job Description: The Executive Director of Defense Operations, within the Cyber Defense organization, is responsible for defining and executing a multi‑year, enterprise‑wide strategy for the Security Operations Center and the Computer Security Incident Response Team functions. This role provides executive leadership for 24x7 security operations capability, ensuring rapid identification, containment, and remediation of cyber threats while continuously advancing the maturity, scalability, and effectiveness of detection and response programs. This role necessitates ability to rapidly triage and categorize remediation efforts, effective dissemination of tasks to pertinent business and technology units, and is a reliable source of understanding the scope and implication (business and/or compliance) of unfolding events. This leader sets the long‑term vision and operating model for security operations, integrating threat intelligence, threat hunting, automation, orchestration, and advanced analytics to improve outcomes at enterprise scale, while driving pertinent alignment and relationships with colleague executives in the business lines within CVS. The Executive Director drives the adoption of leveraged agentic, autonomous and automation capabilities to enhance anomaly detection, threat modeling, remediation triage and predictive response. Partnering closely with business, technology, legal, compliance, and executive stakeholders, this role ensures security operations align with business objectives, regulatory requirements, and evolving threat landscapes. In addition, the Executive Director mentors senior leaders, develops high‑performing global teams, and delivers executive‑level insights, metrics, and strategic guidance that strengthen organizational resilience. Responsibilities: Leadership & Strategy Develop, maintain and execute the enterprise-wide detection and response program aligned with Cyber Defense, larger business objectives, and regulatory requirements. Develop, own and maintain the enterprise Detection and Response Maturity Model, Strategy, Roadmap and Operating Model. Lead and mentor a team of Triage, Detection Engineers, Threat Hunters, and Incident Response professionals, fostering a culture of continuous improvement and operational excellence. Strategize with senior leaders across Product, Engineering, and Security. You are a key stakeholder in the company's direction, advocating for the telemetry and architectural changes required to support future detection use cases. Operational Management Serve as the Incident Commander for major security incidents, coordinating technical teams and executive leadership Develop innovative and cutting-edge detection content aligned with ATT&CK, ATLAS, D3FEND and various other cyber security frameworks Identify and surface patterns to leadership regarding root causes of problems. You anticipate future challenges and own the delivery of solutions before they become bottlenecks. Ensure tracking of OKRs aligned to maturity models, defining, tracking and reporting on KPIs and KRIs to track operational and strategic improvements Collaboration & Communication Partner with threat intelligence, other security teams to enhance detection and response capabilities. Act as a liaison with legal, compliance, and public relations during high-impact incidents. Provide executive-level briefings and actionable insights to senior leadership. Continuous Improvement Drive automation and orchestration initiatives to improve operational efficiency. Monitor emerging threats and adapt operations, tactics, and strategies accordingly. Lead tabletop exercises and other simulations to validate readiness. Required Qualifications: 15+ years of experience in cybersecurity with 8 years in a leadership role managing global detection and response, threat hunting, or security operations teams. Experience developing and executing a long-term strategic vision for security operations at an enterprise scale. Experience leveraging automation and orchestration (i.e., SOAR) to improve the efficiency and effectiveness of a security operations center (SOC). Experience with the application of AI and Machine Learning (AI/ML) on security data for anomaly detection, threat modeling, and predictive security. Experience managing a globally distributed 24/7 security operations team. Experience defining and driving a multiyear strategy for threat detection and response. Strong understanding of security frameworks, risk management, and incident response Deep understanding of people, process, technologies of successful cybersecurity program Strong leadership and people management skills Strong project management and time management skills Proficient in analyzing operational data and creating visualizations and reports Strong communicator, verbal and written, with presenter skills Education Bachelor's degree required or demonstration of specialized training in the areas of SOC / CSIRT military or like-structured methodology Advanced Degree preferred ; technical certifications in advanced management of security incident and remediation will be considered. Pay Range The typical pay range for this role is: $175,100.00 - $334,750.00 This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program. Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong. Great benefits for great people We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families. This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility. Additional details about available benefits are provided during the application process and on Benefits Moments . We anticipate the application window for this opening will close on: 08/29/2026 Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.