Director, Enterprise Secruity

Virta Health; United States; Remote; USD 162,000 - 209,000; Full time

Job summary

Virta Health is seeking a Director of Enterprise Security to build and lead our security operations at scale. This player‑coach role blends hands‑on investigations, detections, and tooling with setting the standards, structure, and roadmap the function will grow into.

You will own SOC design, detection engineering, incident response, and security platform strategy across SIEM, CSPM, CNAPP, and SOAR, protecting patient data while enabling fast, secure product development.

Qualifications

• 10+ years in security operations, detection and response, or cloud security.
• 3+ years leading or mentoring technical security teams.
• Hands-on incident response across logs, endpoints, identity, cloud, SaaS.
• Experience writing detection rules in a detection-as-code model.
• Strong scripting or programming (Python, Go).
• Experience owning and tuning security platforms (SIEM, EDR/XDR, CSPM, SOAR).
• Cloud security experience in GCP with containerized workloads.
• Experience applying AI to security or operations.
• Clear communicator to executives, engineers, and vendors.

Responsibilities

• Direct, mentor, and grow a security operations team.
• Define SOC operating model and staffing roadmap.
• Own detection engineering and observability.
• Lead technical incident response from triage to post-incident review.
• Perform hands-on investigations across logs, identity, cloud, SaaS.
• Develop automated response capabilities and SOAR workflows.
• Lead security platform strategy across CASB, CNAPP, CSPM.
• Coordinate with GRC on automating evidence collection and controls.
• Design AI-assisted capabilities for security operations.

Skills

Security operations

Incident response

Detection rules

MITRE ATT&CK

Scripting

Python

Go

SOAR

SIEM

Cloud security

GCP

AI in security

Tools

SIEM

EDR/XDR

CSPM

SOAR

Job description

Virta Health is on a mission to reverse metabolic disease in one billion people. Current treatment approaches aren’t working—over half of US adults have either type 2 diabetes or prediabetes, and obesity rates are at an all-time high. Virta is changing this by helping people reverse their metabolic condition through innovations in technology, personalized nutrition, and virtual care delivery reinvented from the ground up. We have raised over $350 million from top-tier investors, and partner with the largest health plans, employers, and government organizations to help their employees and members restore their health and take back their lives. Join us on our mission to reverse metabolic disease in one billion people.

As our Director of Enterprise Security, you'll have the rare opportunity to build and shape Virta's security operations function. This is a player-coach role: early on, you'll be hands-on in investigations, detections, and tooling alongside the team, while setting the standards, structure, and direction the function will grow into. You'll build a team where analysts run investigations end to end, then turn what they learn into new detections, automation, and context that make the next investigation faster and better informed. Blending deep technical skill with a fast, well-practiced incident response capability, you'll keep our systems resilient, our end-user workflows frictionless, and our patient data protected.

Responsibilities

• Hands-on Engineering & Operational Leadership: Direct, mentor, and grow a high-performing security operations team. Conduct technical sprint planning, alignment, and coaching while maintaining the technical depth to dive into configurations alongside your team.
• Build the enterprise security function: Shape the team's structure, hiring plan, and long-term roadmap as we grow, including decisions about where to build in-house, where to partner, and how to invest our security budget for the greatest impact.
• Define our SOC operating model: Decide whether we operate in a hybrid or internal model, and design the coverage, on-call, escalation paths, and metrics we use to measure effectiveness.
• Own detection engineering and observability: Design and tune detections as code, ensuring version control and testing, across all security platforms.
• Lead technical incident response: From triage through post-incident review, you will own the management of security incidents, inter-team collaboration and resolution.
• Perform hands-on investigations: Work investigations directly, from log analysis and triage to tracking down identity, cloud, SaaS and endpoint concerns.
• Manage and minimize blast radius: Build and evolve automated response capabilities—leveraging threat models and SOAR orchestration—to neutralize threats before they spread.
• Lead security platform strategy: Own the platforms that give us security visibility across our systems (CASB, CSPM, CNAPP, and more), and keep them tuned as threats change.
• Validate our defenses: Run recurring testing and informed adversary emulation to confirm our posture and the effectiveness of detection and mitigation responses.
• Establish clear security expectations for the enterprise systems we adopt, and lead the evaluation of potential vendors, including business associate agreement (BAA) requirements and HITRUST/SOC 2 assurance expectations.
• Design AI-assisted capabilities: Not just pasting an alert into Claude, but developing context, tools and guidance to provide security operations the ability to stitch together disparate data effectively.
• Partner with GRC to automate compliance: Work closely with the GRC team to automate evidence collection and generation across our security platforms, mapping it to relevant controls.

90 Day Plan

• First 30 days: Deep dive into Virta’s cloud systems and existing security platforms. Establish collaborative, high-trust relationships with your engineering team, IT and GRC peers. Conduct an assessment of our security operations capabilities.
• Day 30-60: Develop your roadmap for the next six months, using your assessment to decide where to formalize and strengthen our security operations standards and processes, with an eye toward integrating our security platforms into a more unified detection and response workflow.
• Day 60-90: Start delivering on the roadmap, prioritizing improvements that reduce manual work and strengthen detection and response. Create a security operations maturity dashboard, present it to executive leadership, and use it to set clear, measurable goals for the next six months.

Must-Haves

• 10+ years in security operations, detection and response, or cloud security, including 3+ years leading or mentoring technical security teams.
• Hands-on incident response experience: you've worked investigations yourself across logs, endpoints, identity, cloud, and SaaS, and you've led incidents from triage through post-incident review.
• Experience writing and maintaining detection rules, ideally in a detection-as-code model, along with a solid understanding of coverage frameworks like MITRE ATT&CK.
• Strong scripting or programming skills (e.g., Python, Go) and a track record of building internal tools, integrations, or automation that made a security team faster.
• Deep experience owning and tuning security platforms such as SIEM, EDR/XDR, CSPM and SOAR, including onboarding new data sources.
• Hands‑on cloud security experience, ideally in GCP with containerized workloads.
• Practical experience applying AI to security or operational work, beyond basic prompting, such as building AI‑assisted workflows, tools, or agents that measurably reduced manual effort.
• Clear communicator who can explain technical risk and security strategy to executives, engineering teams, and vendors.

Values-driven culture

Virta’s company values drive our culture, so you’ll do well if:

• You put people first and take care of yourself, your peers, and our patients equally
• You have a strong sense of ownership and take initiative while empowering others to do the same
• You prioritize positive impact over busy work
• You have no ego and understand that everyone has something to bring to the table regardless of experience
• You appreciate transparency and promote trust and empowerment through open access of information
• You are evidence-based and prioritize data and science over seniority or dogma
• You take risks and rapidly iterate

Virta has a location-based compensation structure. Starting pay will be based on a number of factors and commensurate with qualifications & experience. For this role, the compensation range is $161,500 - 209,000. Information about Virta’s benefits is on our Careers page at: https://www.virtahealth.com/careers.

As part of your duties at Virta, you may come in contact with sensitive patient information that is governed by HIPAA. Throughout your career at Virta, you will be expected to follow Virta's security and privacy procedures to ensure our patients' information remains strictly confidential. Security and privacy training will be provided.

As a remote‑first company, our team is spread across various locations with office hubs in Denver and San Francisco.

Clinical roles: We currently do not hire in the following states: AK, HI, RI.

Corporate roles: We currently do not hire in the following states: AK, DE, HI, ME, MS, OK, SD, VT.