Director, Cyber Engineering and Operations

AMETEK; Berwyn (PA); On-site; USD 180,000 - 225,000; Full time

Job summary

AMETEK, Inc. is a leading global provider of industrial technology solutions with 22,000 employees across 35 countries.

The Director, Cyber Engineering and Operations will lead threat detection, incident response, and vulnerability management across an enterprise environment, guiding a global team and coordinating with MDR providers and internal IT security teams. The role partners with Governance, Risk & Compliance, IAM, Platform Engineering, and Network teams to deliver a resilient, compliant

Qualifications

• BS in Computer Science, Information Systems, or related field; equivalent experience considered.
• 10+ years in cybersecurity with 5+ years leading security operations or incident response.
• Experience managing a globally distributed security team, ideally follow-the-sun.
• Hands-on with EDR/XDR platforms and MDR/EDR providers (CrowdStrike a plus).
• Familiarity with vulnerability scanning tools and remediation workflows.
• Experience managing external vendors and MSSPs against SLAs.
• Exposure to ITAR, CMMC, NIST 800-171 is a plus.
• Certifications: CISSP, GIAC (GCIH/GCIA) or CISM preferred.
• Strong communication skills reporting to IT and executive leadership.
• Experience building or maturing a security operations/IR function from early state.
• IAM/PAM and network security familiarity for cross-team partnership.
• Ability to leverage AI tools to improve productivity and decisions.

Responsibilities

• Define and execute the Security Operations & Incident Response strategy, roadmap, and staffing model.
• Lead a follow-the-sun Incident Response team across US, EU, and Asia.
• Own MDR/EDR provider relationship and SLA performance.
• Mature SOC to cover full estate and govern MDR integration for scale and resilience.
• Serve as incident commander for security incidents and coordinate executive communications.
• Direct security engineering and detection engineering work across the security stack.
• Coordinate incident response playbooks, tabletop exercises, and post-incident reviews.
• Partner with IAM, Platform Engineering, and Network teams to align security architecture.

Skills

EDR/XDR experience

Global team leadership

Cybersecurity strategy

Vendor management

Executive communication

AI for security

Education

BS in Computer Science or related field

CISSP or GIAC or CISM certification

Tools

CrowdStrike

Vulnerability scanning tools

Job description

The Director, Cyber Engineering and Operations is responsible for global threat detection and response, security engineering, and vulnerability management operations across the company's enterprise environment. This role leads a follow-the-sun incident response team spanning the US, EU, and Asia, and owns the operational relationship with the company's managed detection and response (MDR) provider. This role leads the Security Operations & Incident Response function within the Infrastructure, Operations, Architecture & Cyber Defense organization, executing the enterprise cyber defense strategy owned by that leader.

As part of the IT leadership team, this role partners closely with Governance, Risk & Compliance, Identity & Access Management, Enterprise (Infrastructure/Cyber) Architecture, Platform Engineering, and Network teams to deliver a resilient, compliant security operations capability across a global, acquisitive manufacturing environment.

How You Will Make An Impact

• Define and execute the Security Operations & Incident Response strategy, roadmap, and staffing model.
• Lead a follow-the-sun Incident Response team covering detection, triage, and response across US, EU, and Asia regions.
• Own the relationship and SLA performance for the company's managed detection and response (MDR/EDR) provider.
• Mature the Security Operations Center (SOC) capability that provides detection and response coverage across the full estate — not only assets covered by the managed service — integrating and governing the MDR service for scale and surge and reducing reliance on it over time.
• Serve as operational incident commander for security incidents, escalating major incidents and executive communications to the Director, Infrastructure, Operations, Architecture & Cyber Defense in accordance with the incident response plan.
• Direct security engineering and detection engineering work, including tuning and content development across the security stack.
• Administer the vulnerability scanning toolset and lead remediation engineering, in partnership with GRC on policy and risk reporting and with functional IT teams on remediation execution.
• Coordinate incident response playbooks, tabletop exercises, and post-incident reviews.
• Partner with Identity & Access Management, Platform Engineering, and Network teams to align security architecture and controls across the environment.
• Partner with the Enterprise (Infrastructure/Cyber) Architect to ensure security requirements and controls are designed into platforms, transitions, and provider operations on a secure-by-design basis.
• Coordinate handoff protocols with third-party MSSPs supporting regulated enclaves (e.g., CMMC).
• Deliver regular security operations metrics, incident reporting, and program status to IT leadership.
• Contribute security operations metrics and maturity evidence to Enterprise Risk Management, the enterprise cybersecurity maturity roadmap (NIST CSF) and to board-level cyber reporting.
• Provide security operations input to M&A cyber due diligence and the rapid onboarding of acquisitions into monitoring and response coverage.
• Support audit readiness and evidence collection for relevant regulatory frameworks (ITAR, CMMC, NIST 800-171).

What You Will Bring To The Role

• BS in Computer Science, Information Systems, or related field; equivalent experience considered.
• 10+ years in cybersecurity, including 5+ years leading a security operations or incident response function.
• Experience managing a globally distributed security team, ideally in a follow-the-sun model.
• Hands-on experience with EDR/XDR platforms and managed detection service providers (CrowdStrike experience a plus).
• Familiarity with vulnerability scanning tools and remediation workflows.
• Experience managing external vendors and MSSPs against defined SLAs.
• Exposure to regulated environments (ITAR, CMMC, NIST 800-171) is a plus.
• Certifications (Preferred): CISSP, GIAC (GCIH, GCIA, or similar), CISM.
• Strong communication skills and comfort reporting to IT and executive leadership.
• Experience building or maturing a security operations and incident response function from an early or under-developed state.
• Working familiarity with identity and access management (IAM/PAM) and network security concepts, sufficient to partner effectively with those peer functions.
• Demonstrated ability and willingness to use AI tools to improve productivity, decision-making, work quality, and to reduce costs. The successful candidate must be able to identify appropriate AI use cases and critically evaluate AI-generated outputs.

Compensation

• Employee Type: Salaried
• Currency: USD
• Salary Minimum: 180,000
• Salary Maximum: 225,000
• Incentive: Yes
• Disclaimer: Where a specific pay range is noted, it is a good faith estimate at the time of this posting. The actual salary offered will be based on experience, skills, qualifications, market / business considerations, and geographic location.

AMETEK, Inc. is a leading global provider of industrial technology solutions serving a diverse set of attractive niche markets with annual sales over $7.5 billion.

AMETEK is committed to making a safer, sustainable, and more productive world a reality. We use differentiated technology solutions to solve our customers' most complex challenges. We employ 22,000 colleagues, in 35 countries, that are grounded by our core values: Ethics and Integrity, Respect for the Individual, Inclusion, Teamwork, and Social Responsibility. AMETEK is a component of the S&P 500. Visit https://www.ametek.com/careers for more information.

We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, national origin, religion, sexual orientation, gender identity, status as a veteran, and basis of disability or any other federal, state or local protected class. Individuals who need a reasonable accommodation because of a disability for any part of the employment process should call 1 [phone].