Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

Envista; Brea (CA); On-site; USD 156,000 - 191,000; Full time

Benefits offered by this job

Health & Wellbeing

Retirement & Financial Benefits

Life & Disability Insurance

Paid Time Off

Learning & Career Development

Job summary

Envista seeks a strategic Security Operations and Engineering Lead to drive enterprise cybersecurity operations, detection engineering, and incident response. This onsite role manages the SOC, IAM, and security tooling, coordinating with MSSP/MDR partners and cross-functional teams.

The position requires guiding a threat-informed security program, building scalable detections, and leading incidents from containment to lessons learned. Relocation to Irvine/Brea area anticipated, 4 days onsite.

Qualifications

• 7+ years of experience in cybersecurity, security operations, detection engineering, or incident response.
• 5+ years leading security operations, engineering, SOC, or incident response teams.
• Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.
• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle).
• Experience in Azure, AWS, or GCP environments.
• Ability to communicate technical risks to executive leadership and business stakeholders.

Responsibilities

• Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.
• Oversee SOC and MSSP/MDR partnerships with SLAs, alert quality, escalation paths, and metrics.
• Define KPIs/KRIs including MTTD, MTTR, alert fidelity, and detection coverage.
• Lead lifecycle management of SIEM, SOAR, EDR/XDR, CSPM, DLP, identity, and cloud platforms.
• Coordinate major incidents through containment, eradication, and recovery with post-incident reviews.
• Build detection engineering lifecycle: hypothesis testing, tuning, deployment, and retirement.
• Partner with Legal, Privacy, HR, IT, and Communications for incident handling and governance.
• Drive automation across triage, enrichment, containment, and reporting workflows.

Skills

Security leadership

Security operations management

Incident response coordination

Threat detection engineering

MITRE ATT&CK approach

Cloud security

Education

Bachelor's degree in Information Security, Cybersecurity, CS, IS, Business, Engineering, or related field

Tools

Microsoft Sentinel

Splunk

QRadar

Chronicle

EDR/XDR tooling

Job description

United States of America, California, Brea | United States of America, California, IrvineR5026845United States of AmericaInformation TechnologyJob descriptionJOB SUMMARYCandidates must reside within a commutable distance to both Brea, CA and Irvine, CA, as the office location will be relocated from Brea to Irvine in approximately Q1 2028. This is not a hybrid or remote opportunity and requires onsite presence 4 days per week.We are seeking a strategic and hands-on Security Operations and Engineering Lead to drive enterprise cybersecurity operations, detection engineering, incident response, and security platform capabilities. This leader owns the SOC, incident response program, detection lifecycle, and security tooling ecosystem, and is responsible for building scalable, threat-informed, and measurable security operations.PRIMARY DUTIES AND RESPONSIBILITIES:Security Operations LeadershipLead enterprise security operations including monitoring, triage, investigation, escalation, and responseOversee SOC and MSSP/MDR partnerships including SLAs, alert quality, escalation paths, and performance metricsEstablish 24x7 monitoring aligned to enterprise riskDefine KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectivenessSecurity Engineering & Platform ManagementLead lifecycle management of SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platformsDrive automation across triage, enrichment, containment, and reporting workflowsDefine enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standardsEnsure tools are integrated, cost-effective, and aligned to risk prioritiesIncident Response & Threat ManagementOwn incident response program including playbooks, exercises, breach workflows, and communicationsLead major incidents through containment, eradication, recovery, and root cause analysisEnsure post-incident reviews drive durable control improvementsCoordinate with Legal, Privacy, HR, IT, and CommunicationsDetection Engineering & MonitoringBuild detection engineering lifecycle: hypothesis development testing tuning deployment validation retirementDevelop behavior-based and threat-informed detections aligned to MITRE ATT&CKExpand monitoring across endpoint, identity, cloud, SaaS, network, and critical applicationsIdentify and close detection gaps via red team, pentest, and vulnerability insightsExposure & Control OperationsSupport exposure management, asset inventory visibility, and attack surface monitoringDrive continuous control monitoring and validation of key security controlsImprove vulnerability remediation workflows and risk reduction outcomesLeadership & Stakeholder ManagementBuild and lead high-performing security operations and engineering teamsEstablish clear roles, operating model, and accountabilityProvide executive reporting on threats, incidents, control gaps, and maturityPartner with GRC, Audit, IT, Architecture, and business leadershipJob requirementsBachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering, or a related fields OR equivalent industry experience, military service, professional certifications, and demonstrated leadership experience are valued equally.7+ years of experience in cybersecurity, security operations, detection engineering, incident response, or security engineering.5+ years leading security operations, engineering, SOC, or incident response teams.Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.Experience managing MSSP, MDR, SOC-as-a-Service, or strategic security service providers.Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle, etc.)Experience in Azure, AWS, or GCP environments.Understanding of Zero Trust security principles and modern detection strategies.Ability to communicate technical risks to executive leadership and business stakeholders.Experience coordinating investigations across security, IT, legal, privacy, HR, and executive stakeholders.PREFERRED SKILLS & EXPERIENCE:10+ years of cybersecurity experience.Experience building or transforming a SOC program.Experience supporting a global or multi-business-unit environment.Experience leading incident response for major cybersecurity events.One or more of the following certifications: CISSP; CISM; CCSP; GIAC certifications (GCIH, GCIA, GCFA, GMON); Microsoft Security certifications; Splunk certifications; Microsoft Sentinel certifications; CrowdStrike certifications; AWS/Azure/GCP security certifications.#LI-SC1IND123Target Market Salary Range:Actual compensation packages take into account a wide range of factors that are unique to each candidate, including but not limited to geographic location; skill sets; relevant education and certifications; depth of experience; performance; and other business and organizational needs. The disclosed reasonable estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Envista, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. The total compensation package for this position may also include an annual performance bonus, medical/dental/vision benefits, 401K match, and/or other applicable compensation plans.$156,400 - $191,200Operating Company:CorporateEnvista and its family of companies (Envista) will not accept unsolicited resumes from any source other than directly from a candidate. Envista will consider unsolicited referrals and/or resumes submitted by vendors such as search firms, staffing agencies, professional recruiters, fee-based referral services and recruiting agencies (Agency) to have been referred by the Agency free of charge and Envista will not pay a fee for any placement resulting from the receipt such unsolicited resumes. An Agency must obtain advance written approval from Envista's internal Talent Acquisition or Human Resources team to submit resumes, and then only in conjunction with a valid fully-executed contract approved by the Global Talent Acquisition leader and in response to a specific job opening. Envista will not pay a fee to any Agency that does not have such agreement and written approval in place.Envista and all Envista Companies are equal opportunity employers that evaluate qualified applicants without regard to race, color, national origin, religion, sex, age, marital status, disability, veteran status, sexual orientation, gender identity, or other characteristics protected by law. The “EEO is the Law” poster is available at: https://www.dol.gov/sites/dolgov/files/ofccp/regs/compliance/posters/pdf/eeopost.pdfRead moreCorporateOperating Company:CorporateLocation:United States of America, California, Brea | United States of America, California, IrvineDate Posted:September 13 , 2026Req Number:R5026845BenefitsCaring for our employees and their familiesHealth & WellbeingWe offer comprehensive programs designed to support the health and wellbeing of our employees and their families. From medical coverage to wellness resources, we prioritize helping our people thrive both physically and mentally.Retirement & Financial BenefitsWe are committed to supporting our employees’ financial wellbeing—today and in the future. Our competitive compensation and retirement or savings programs are designed to help employees build financial confidence at every stage of their careers.Life & Disability InsuranceWe provide benefits that help protect employees and their loved ones when it matters most. Depending on location, our life and disability programs offer valuable financial security and added peace of mind during unexpected life events.Paid Time OffWe know that time away from work is essential for rest, balance, and personal priorities. Our paid time off, holidays, and leave programs are designed to give employees the flexibility to recharge and take care of what matters most.Learning & Career DevelopmentWe believe in investing in our people. Through learning opportunities, development programs, and career growth pathways, we empower employees to build meaningful careers and continue growing with us.Our hiring processAt Envista, we’re committed to helping you feel confident and prepared every step of the way. Our interview guide will walk you through what to expect, how to showcase your strengths, and how you can make an impact by helping us champion dental professionals and improve lives.1. Application ReviewAfter you apply, our team will review your experience and qualifications. If your background aligns with the role, a recruiter will reach out to discuss the opportunity and next steps.2. InterviewsYou’ll meet with members of the hiring team to learn more about the role and share your experience. Depending on the position, this may include multiple conversations focused on your skills, experience, and how you can make an impact.3. Offer DecisionIf selected, you’ll receive an offer outlining compensation, benefits, and other details. Our team will guide you through the process and answer any questions to help you make an informed decision.4. OnboardingOnce you join, we’ll support your transition with onboarding resources and guidance to help you get started and feel connected from day one.