Director, Cyber Defense

Genuine Parts Company; Atlanta (GA); On-site; USD 180,000 - 260,000; Full time

Job summary

Genuine Parts Company is seeking a strategic Director of Cyber Defense who will own the full cyber defense mission, including threat detection, incident response, threat intelligence, threat hunting, and digital forensics. You will oversee global IT security monitoring across a multi-entity environment to ensure consistent visibility and rapid response.

The ideal candidate has deep operational security experience and a track record of building teams, with a vision for agentic cyber defense and

Qualifications

• Bachelor's degree in computer science, information security, or related field.
• 10+ years in cyber defense or security operations with 5+ years leading teams.
• Experience applying AI/ML and automation to security operations.
• Knowledge of AI security governance and LLM/agentic workloads.
• Experience with security monitoring at scale in multi-tenant environments; regulated industries preferred.
• Professional certifications such as CISSP, CISM, GCIH, GCFA or equivalent.
• Familiarity with NIST CSF, ISO 27001, CIS, GDPR.

Responsibilities

• Own and mature the enterprise cyber defense function across detection, incident response, threat intelligence, threat hunting, and DFIR.
• Direct 24x7 global IT security monitoring across a multi-tenant environment.
• Lead AI agentic cyber defense initiatives with human-in-the-loop controls.
• Establish governance for AI used in cyber defense.
• Own the enterprise incident response framework and lead major incident command.
• Direct SIEM/SOAR strategy and engineering.
• Mature threat intelligence program with PIR-driven collection.
• Engage stakeholders and report posture to executives and boards.
• Build and retain a high-performing cyber defense team.
• Ensure regulatory alignment across portfolio including banking entities.

Skills

AI/ML in security ops

Threat detection

Incident response

Threat hunting

Digital forensics

Security operations leadership

Education

Bachelor’s degree in CS or InfoSec

Advanced degree preferred

Tools

Microsoft Sentinel

Microsoft Defender suite

Entra ID

KQL

Python

PowerShell

SOAR platforms

Job description

The Position

The Director of Cyber Defense reports to the Chief Information Security Officer and operates within the Office of the CISO. This role owns the full cyber defense mission: threat detection, incident response, threat intelligence, threat hunting, and digital forensics. The Director is accountable for global IT security monitoring across this multi-entity, multi-tenant environment, ensuring consistent visibility, detection coverage, and response readiness regardless of where in the ecosystem a threat emerges.

The ideal candidate pairs deep operational cyber defense expertise with a demonstrated record of building teams, transforming operating models, and applying security operations at scale.

Responsibilities

• Cyber defense leadership:Own and mature the enterprise cyber defense function, spanning detection engineering, incident response, threat intelligence, threat hunting, and DFIR, setting strategy, standards, and operational metrics across the Ecosystem.
• Global monitoring across a diverse ecosystem:Direct 24x7 global IT security monitoring across a multi-tenant environment serving a diverse ecosystem of companies, including regulated financial entities, ensuring consistent telemetry coverage, detection fidelity, and response SLAs for every entity.
• Agentic cyber defense:Lead the organization in AI adoption by architecting and delivering an agentic cyber defense model, deploying AI agents for alert enrichment, triage, investigation, detection engineering, and automated response, with clearly defined human-in-the-loop controls, guardrails, and escalation paths.
• Secure AI:Establish and enforce governance for AI used in cyber defense (model risk, data handling, auditability, and acceptable use), and defend the enterprise's AI estate, including AI gateways, model endpoints, agent frameworks, and AI-enabled SaaS, against emerging threats such as prompt injection, model abuse, and data exfiltration.
• Incident response:Own the enterprise incident response framework and entity-specific playbooks; lead major incident command, coordinate cross-entity response, and drive post-incident reviews, root cause analysis, and control improvements.
• Detection and automation engineering:Direct SIEM/SOAR strategy and engineering, driving AI/ML-enhanced detections, behavioral analytics, and intelligent automation to improve signal-to-noise ratio and reduce time to detect and respond.
• Threat intelligence and hunting:Mature the threat intelligence program with PIR-driven collection and dissemination, and lead proactive, hypothesis-driven threat hunting across the ecosystem.
• Stakeholder engagement:Partner with entity leadership, IT, engineering, legal, and compliance; represent cyber defense in architecture reviews and risk governance forums; report operational posture and metrics to executive leadership and boards.
• Team leadership:Build, coach, and retain a high-performing cyber defense team; accurately assess performance, develop talent, and evolve roles as agentic capabilities reshape the operating model.
• Regulatory alignment:Ensure monitoring and response capabilities satisfy regulatory obligations across the portfolio, including federally regulated banking entities, and support audits, examinations, and legal matters as required.

Requirements

• Bachelor’s degree in computer science, Information Security, or a related field; advanced degree a plus.
• 10+ years of progressive experience in cyber defense or security operations, including 5+ years leading teams, with direct accountability for detection, incident response, and threat intelligence functions.
• Demonstrated experience applying AI/ML and automation to security operations, and a credible vision for building agentic cyber defense capabilities with appropriate human oversight.
• Working knowledge of AI security and governance: securing LLM/agentic workloads, AI gateways, and model endpoints, and familiarity with frameworks such as the NIST AI RMF, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.
• Deep expertise in the Microsoft security ecosystem (Sentinel, Defender suite, Entra ID) and modern SOAR platforms; proficiency with KQL, Python, and PowerShell.
• Experience running security monitoring at scale in multi-tenant, multi-entity, or shared-services environments; exposure to regulated industries (e.g., OCC/FDIC-supervised banking) strongly preferred.
• Experience implementing and operationalizing enterprise data classification and protection programs, including sensitivity labeling, data loss prevention, and data security posture management (e.g., Microsoft Purview, DSPM platforms), with the ability to align detection and response priorities to data classification tiers.
• Strong understanding of data protection controls across cloud and endpoint environments, including encryption, key management, data residency, and insider risk monitoring, and their application in regulated and multi-entity contexts.
• Strong command of adversary tradecraft and frameworks including MITRE ATT&CK, and experience operationalizing threat intelligence.
• Possession of, or ability to obtain, professional certifications such as CISSP, CISM, GCIH, GCFA, or equivalent.
• Strong knowledge of security, regulatory, and control frameworks such as NIST CSF, ISO 27001, CIS, and GDPR.
• Exceptional communication skills, with the ability to convey security and risk concepts to technical teams, executives, and boards.
• High level of personal integrity and the ability to professionally handle confidential matters.
• Strong coaching and team-building skills, with the ability to motivate others through direct and indirect reporting relationships to achieve objectives.

GPC conducts its business without regard to sex, race, creed, color, religion, marital status, national origin, citizenship status, age, pregnancy, sexual orientation, gender identity or expression, genetic information, disability, military status, status as a veteran, or any other protected characteristic. GPC's policy is to recruit, hire, train, promote, assign, transfer and terminate employees based on their own ability, achievement, experience and conduct and other legitimate business reasons.