Director of Cyber Defense

Gotham Technology Group; Irving (TX); On-site; USD 180,000 - 280,000; Full time

Job summary

Gotham Technology Group seeks an AI-first cyber defense leader to own detection, response, threat intel, hunting, and forensics as a shared service with global visibility.

Lead the build-out of an agentic SOC using AI agents for triage, investigations, and automated response, under strong human oversight, while securing AI platforms and workloads.

Qualifications

• Extensive operational cybersecurity leadership experience.
• Experience building and scaling security teams.
• Experience scaling AI/ML in security operations.

Responsibilities

• Own cyber defense end-to-end: detection, response, intel, hunting, DFIR.
• Direct 24x7 global monitoring across multi-tenant environments.
• Build agentic SOC with AI agents for triage, investigation, and automated response.
• Govern AI systems: AI risk, data handling, and auditability; protect AI gateways and agents.
• Lead incident response framework and playbooks; drive post-incident reviews.
• Drive SIEM/SOAR strategy and AI-enhanced detections.
• Mature threat intel and proactive hunting programs.
• Engage across leadership, IT, legal, and compliance; report posture to executives.

Skills

AI/ML in security

Security leadership

Threat intel

Incident response

DFIR

Stakeholder engagement

Tools

Microsoft Sentinel

Job description

Lead cyber defense for a diverse, multi-entity ecosystem. You'll own detection, response, threat intelligence, hunting, and forensics as a shared service — with global visibility and consistent readiness no matter where a threat surfaces.

This is an AI-first leadership role. You'll pioneer agentic cyber defense — deploying AI agents to triage, investigate, and respond under strong human oversight — while also securing the AI platforms and agentic workloads the business runs on.

You're a fit if you bring: deep operational expertise in the Microsoft security ecosystem, a track record building and transforming security teams, and real experience scaling AI/ML into security operations.

What You'll Do

• Own cyber defense end-to-end — set strategy, standards, and metrics across detection engineering, IR, threat intel, hunting, and DFIR
• Direct 24x7 global monitoring across a multi-tenant environment, including regulated financial entities, with consistent coverage and SLAs
• Build the agentic SOC — architect AI agents for alert enrichment, triage, investigation, and automated response, with clear guardrails and escalation paths
• Govern and defend AI itself — set standards for AI risk, data handling, and auditability; protect AI gateways, model endpoints, and agent frameworks from prompt injection, abuse, and exfiltration
• Command incident response — own the IR framework and playbooks, lead major incidents, drive post-incident reviews and fixes
• Drive detection engineering — lead SIEM/SOAR strategy, AI-enhanced detections, and behavioral analytics to cut time-to-detect and time-to-respond- Microsoft Sentinel
• Mature threat intel & hunting — run a PIR-driven intel program and proactive, hypothesis-based hunting
• Engage stakeholders — partner across entity leadership, IT, legal, and compliance; report posture to executives and boards
• Build the team — hire, coach, and evolve roles as agentic tools reshape how the work gets done
• Keep it compliant — ensure monitoring and response meet regulatory obligations, including for federally regulated banking entities