Cyber Defense, Adversary Emulation Director

Mizuho Financial Group Inc.; Northern (KY); Hybrid; USD 150,000 - 225,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

401K plan

Job summary

Mizuho Financial Group, Inc. is seeking a Cyber Defense, Adversary Emulation Director to lead vulnerability management, threat intelligence, threat hunting, and red team operations across the enterprise.

The role combines hands-on offensive security with strategic leadership, partnering with security engineering, incident response, and technology teams to reduce risk. You will drive remediation by translating threat findings into actionable guidance, while leveraging automation, AI-enabled

Qualifications

• 10+ years of information security experience, with deep expertise in vulnerability management, threat intel, hunting, red team, or offensive security.
• Proven red team/adversary emulation leadership and actionable remediation translation.
• Hands-on vulnerability management across infrastructure, applications, and cloud for global orgs.
• Strong threat intelligence collecting, analyzing, and operationalizing TTPs (MITRE ATT&CK).
• Threat hunting across endpoint, network, and cloud telemetry to detect threats.
• Strong scripting ability (Python/PowerShell) to support automation.
• Familiarity with offensive security tooling and testing methodologies.
• Knowledge of security operations, cloud security, and regulatory environments.
• Ability to drive remediation with engineering and business stakeholders.
• Excellent communication for both technical and non-technical audiences.

Responsibilities

• Lead and mature the enterprise vulnerability management program across infra, apps, and cloud.
• Direct threat intelligence operations to inform priorities and proactive hunting.
• Plan and lead threat-hunting campaigns across endpoints, networks, and cloud.
• Design and lead red team and adversary emulation exercises to test controls.
• Translate findings into prioritized, actionable remediation guidance for engineering.
• Partner with Security Operations and infrastructure teams to close weaknesses.
• Establish metrics and governance to measure risk reduction and remediation timeliness.
• Develop and mentor a team of analysts across vulnerability management, threat intel, hunting, and red team.
• Leverage automation and AI tooling to scale triage, threat analysis, and hunting.

Skills

Vulnerability management

Threat intelligence

Threat hunting

Adversary emulation

Red team operations

Python scripting

Cloud security

MITRE ATT&CK

Leadership

Cybersecurity operations

Education

BS/MS in Information Technology, Computer Science, Engineering, Cybersecurity, or related field

Tools

Cobalt Strike

Metasploit

BloodHound

Nmap

Burp Suite

SIEM

EDR/XDR

Job description

Join Mizuho as a Cyber Defense, Adversary Emulation Director! The Cyber Defense organization within Mizuho Americas Services (MAS) operates under the CISO and is responsible for identifying, analyzing, and mitigating cyber threats across the Mizuho enterprise.

The Adversary Emulation function plays a critical role in proactively improving the firm’s security posture by leveraging vulnerability intelligence of real‑world threats, identifying systemic weaknesses, and driving remediation across infrastructure, applications, and cloud environments. The Adversary Emulation Director leads Mizuho's proactive security functions, with primary responsibility for vulnerability management, threat intelligence, threat hunting, and red team operations across the enterprise. This role focuses on identifying, prioritizing, and driving remediation of real‑world threats across the enterprise, thinking like an attacker to emulate adversary tactics to continuously test and strengthen the firm’s defenses. The role combines deep hands‑on offensive and threat expertise with strategic leadership, partnering with security engineering, incident response, and technology teams to translate threat insight into measurable risk reduction. Automation, AI‑enabled tooling, and workflow orchestration are applied to scale these capabilities and improve analyst efficiency, but they supplement — rather than define — the core mission of vulnerability management, threat intelligence, threat hunting, and adversary emulation.

Key Responsibilities

• Lead and mature the enterprise vulnerability management program, including discovery, risk‑based prioritization, remediation tracking, and reporting across infrastructure, applications, and cloud environments.
• Direct threat intelligence operations, collecting and analyzing intelligence on threat actors, tactics, techniques, and procedures (TTPs), and emerging vulnerabilities to inform defensive priorities and proactive hunting.
• Plan and lead threat hunting campaigns that proactively identify malicious activity, misconfigurations, and systemic weaknesses across endpoint, network, and cloud environments.
• Design and lead red team and adversary emulation exercises that replicate real‑world attacker tactics to test detection, response, and control effectiveness across the enterprise.
• Translate findings from vulnerability management, threat intelligence, hunting, and red team activity into clear, prioritized, and actionable remediation guidance for engineering and business stakeholders.
• Partner with Security Operations, incident response, and infrastructure teams to drive closure of identified weaknesses and continuously improve the firm's security posture.
• Establish metrics, reporting, and governance that measure risk reduction, remediation timeliness, and the effectiveness of the firm's offensive and proactive security programs.
• Develop and mentor a team of analysts and engineers across vulnerability management, threat intelligence, threat hunting, and red team functions, fostering a collaborative, learning‑driven culture.
• Leverage automation, AI‑enabled tooling, and workflow orchestration to scale vulnerability triage, threat analysis, and hunting, reducing manual effort while maintaining accuracy, auditability, and control.
• Contribute to standards, playbooks, documentation, and controls that promote consistency, repeatability, and shared ownership across the firm's proactive and offensive security functions.

Qualifications

• 10+ years of experience in information security, with deep expertise across vulnerability management, threat intelligence, threat hunting, red team, or offensive security, preferably within financial services or another regulated enterprise environment.
• Proven experience leading or executing red team and adversary emulation engagements, including planning, execution, and translating findings into actionable remediation.
• Hands‑on experience running vulnerability management programs and platforms, including discovery, risk‑based prioritization, and remediation tracking across infrastructure, applications, and cloud, preferably for a global organization.
• Strong threat intelligence experience — collecting, analyzing, and operationalizing threat actor TTPs and emerging vulnerabilities, mapped to frameworks such as MITRE ATT&CK.
• Demonstrated threat hunting experience across endpoint, network, and cloud telemetry to proactively detect malicious activity and systemic weaknesses.
• Strong hands‑on scripting skills (Python, PowerShell, or similar) to support testing, analysis, and automation of offensive and proactive security workflows.
• Strong understanding of offensive security tooling and techniques, such as command‑and‑control (C2) frameworks, exploitation, penetration testing methodologies, and adversary TTP emulation.
• Strong understanding of cybersecurity operations, threat detection, incident response, vulnerability management, cloud security, and security monitoring concepts.
• Familiarity with governance models, control requirements, auditability, and risk management practices applicable to automation in a regulated environment.
• Ability to collaborate with security engineers, analysts, architects, and business stakeholders to drive prioritized remediation and risk reduction aligned to operational priorities.
• Strong written and verbal communication skills, with the ability to explain technical concepts, threats, risks, and remediation priorities to both technical and non‑technical audiences.
• Educational background with a BS/MS in Information Technology, Computer Science, Engineering, Cybersecurity, or a related field, or equivalent practical experience.

Additional Qualifications

• Hands‑on experience with vulnerability management platforms, SIEM, EDR/XDR, threat intelligence platforms, and offensive security tooling (e.g., Cobalt Strike, Metasploit, BloodHound, Nmap, Burp Suite).
• Experience applying AI or LLM‑based tooling to security workflows — such as automated triage, enrichment, or human‑in‑the‑loop analysis — as a supplement to core offensive and threat capabilities.
• Experience assessing cloud security, containerization, and infrastructure as code from an offensive or adversarial perspective.
• Relevant certifications such as OSCP, OSEP, GXPN, GPEN, GCIH, GCTI, GREM, CISSP, or CISM.
• Experience working in financial services, banking, or another highly regulated environment.
• Demonstrated ability to build playbooks, documentation, standards, and shared practices across proactive and offensive security teams.

Salary & Benefits

The expected base salary ranges from $150,000 - $225,000. Salary offers are based on a wide range of factors including relevant skills, training, experience, education, and, where applicable, certifications and licenses obtained. Market and organizational factors are also considered. In addition to salary and a generous employee benefits package, including Medical, Dental and 401K plans, successful candidates are also eligible to receive a discretionary bonus.

Other Requirements

Mizuho has in place a hybrid working program, with varying opportunities for remote work depending on the nature of the role, needs of your department, as well as local laws and regulatory obligations. Roles in some of our departments have greater in‑office requirements that will be communicated to you as part of the recruitment process.

Company Overview

Mizuho Financial Group, Inc. is the 15th largest bank in the world as measured by total assets of ~$2 trillion. Mizuho's 60,000 employees worldwide offer comprehensive financial services to clients in 35 countries and 800 offices throughout the Americas, EMEA and Asia. Mizuho Americas is a leading provider of corporate and investment banking services to clients in the US, Canada, and Latin America. Through its acquisition of Greenhill, Mizuho provides M&A, restructuring and private capital advisory capabilities across Americas, Europe and Asia. Mizuho Americas employs approximately 3,500 professionals, and its capabilities span corporate and investment banking, capital markets, equity and fixed income sales & trading, derivatives, FX, custody and research. Visit www.mizuhoamericas.com. Mizuho Americas offers a competitive total rewards package. We are an EEO/AA Employer - M/F/Disability/Veteran. We participate in the E-Verify program. We maintain a drug‑free workplace and reserve the right to require pre‑ and post‑hire drug testing as permitted by applicable law.

Why Mizuho

Mizuho is in growth mode as we are climbing the league tables, disrupting the status quo, and attracting top talent. Positions are available across our corporate functions, and on our corporate and investment banking, capital markets, advisory, research, sales & trading, derivatives, and financing teams. We are looking for candidates who want to contribute to our entrepreneurial culture where people at all levels are inspired to share ideas. Our creativity sets us apart, and our perseverance drives results in creating bespoke, client‑focused solutions. If you are interested in advancing your career working for a firm with a growth mindset and the resources of a global financial services team, we would like to hear from you. For more information, please view our Recruiting Brochure