Director, Security Operations & Incident Response

CVS Health; Providence (RI); On-site; USD 144,000 - 288,000; Full time

Job summary

CVS Health is seeking a Lead Director for Security Operations Center (SOC) to drive cybersecurity operations, threat detection, and incident response for a complex healthcare business. You will establish processes, lead cross-functional teams, and align security with regulatory requirements and business goals.

Your leadership will shape detection engineering, automation, and resilience across cloud and on‑prem environments, partnering with engineering, risk, and compliance to reduce risk and

Qualifications

• 10+ years of progressive cybersecurity experience within medium-large scale environments.
• 5+ years leading Security Operations Center (SOC), Incident Response, Cyber Defense, or Threat Detection teams.
• 5+ years operating and optimizing enterprise security platforms (SIEM, EDR/XDR, SOAR, and security automation).
• 3+ years building, managing, and maturing security operations capabilities including monitoring, threat hunting, IR, forensics, and investigations.

Responsibilities

• Lead the strategy, execution, and continuous improvement of the SOC, including threat monitoring, detection, investigation, response, and threat hunting.
• Establish operational processes, service levels, metrics, and reporting to measure effectiveness.
• Build and mature SOC capabilities aligned with business priorities and risk tolerance.
• Ensure coordination during cybersecurity events and incidents.

Skills

Cybersecurity experience

SOC leadership

Threat detection

Incident response

Security automation

Education

Bachelor's degree in Cybersecurity/IT/CS/Engineering

Tools

SIEM

EDR/XDR

SOAR

Microsoft Sentinel

CrowdStrike Falcon

Wirespeed

Job description

CVS Health is seeking a Lead Director for Security Operations Center (SOC) to drive cybersecurity operations, threat detection, and incident response for a complex healthcare business. You will establish processes, lead cross-functional teams, and align security with regulatory requirements and business goals.

Your leadership will shape detection engineering, automation, and resilience across cloud and on‑prem environments, partnering with engineering, risk, and compliance to reduce risk and