Head of Cybersecurity Defense Operations

M&T Bank Corporation; Buffalo (NY); Hybrid; USD 168,000 - 279,000; Full time

Job summary

M&T Bank Corporation in Buffalo, NY is seeking a strategic Head of Cyber Defense Operations to lead enterprise cyber defense capabilities across detection, response, and recovery. This role coordinates with Threat Intelligence, Threat Hunt, and Detection Engineering to maintain 24x7x365 security resilience.

You will direct CSOC operations, Incident Response, Insider Threat, and DLP programs, driving automation and AI-enabled improvements while partnering with Technology, Risk, Compliance, Audit,

Qualifications

• Bachelor's degree and 9+ years of relevant work experience.
• Or 13 years combined higher education and/or work history.
• Minimum 3 years of managerial experience.

Responsibilities

• Oversee CSOC operations, monitoring, triage, and containment of incidents.
• Modernize cyber defense through automation, AI-enabled capabilities, and analytics.
• Oversee CIRT incident response, recovery, and post-incident reviews.
• Act as Cyber Incident Commander for high-severity incidents.
• Collaborate with Threat Intelligence, Threat Hunting, and Detection Engineering.

Skills

Cybersecurity leadership

SOC/CSOC experience

Threat intelligence collaboration

Education

Bachelor's degree

Tools

SIEM

SOAR

EDR

Job description

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week Overview: M&T Bank is seeking a strategic and transformational cybersecurity leader to serve as Head of Cyber Defense Operations. This role is accountable for leading the Bank's enterprise cyber defense capabilities, ensuring the continuous identification, protection, detection, response, and recovery from cybersecurity threats impacting the Bank's technology assets, customers, colleagues, and operations. The Cybersecurity Operations division serves as the focal point for M&T's 24x7x365 cyber defense mission and first-line cybersecurity response capabilities. The Head of Cyber Defense Operations will oversee multiple cyber defense functions and will work in close partnership with Threat Intelligence, Threat Hunt and Detection Engineering teams to ensure a unified, intelligence-driven cyber defense mission across the enterprise. This leader will partner closely with Technology, Enterprise Risk, Compliance, Audit, Corporate Security, and executive leadership to strengthen the Bank's cyber resilience and operational readiness in an increasingly complex threat landscape. This leader plays a key role in executing enterprise-scale cybersecurity programs, contributes to the Bank's cybersecurity transformation initiatives, and leads managers and senior technical leaders across the cyber defense mission. Reporting to the Director of Cybersecurity Operations, the Senior Manager translates enterprise strategy into operational execution, ensuring the Bank's detection, response, and insider risk capabilities function as a single, integrated defense mission.

Primary Responsibilities

• Operational leadership and execution of the Bank's Cyber Defense Operations strategy and roadmap, ensuring alignment with Cybersecurity, Technology, Operational Resilience, and enterprise risk management objectives.
• Provide strategic oversight and leadership for enterprise cyber defense capabilities, including security monitoring, threat detection, incident response, threat intelligence, threat hunting, insider threat, data loss prevention, and cyber defense engineering functions.
• Direct the operations and continuous maturation of the Cybersecurity Operations Center (CSOC), ensuring effective monitoring, triage, response, escalation, and containment of cybersecurity events across the enterprise.
• Lead strategic initiatives to modernize cyber defense operations through automation, advanced analytics, threat-informed defense methodologies, AI-enabled capabilities, and operational efficiencies while maintaining or improving security outcomes.
• Provide executive oversight of the Bank's Cybersecurity Incident Response Team (CIRT), ensuring effective preparedness, incident handling, recovery, after-action reviews, and continuous improvement of incident response processes.
• Serve as (or designate) the Cyber Incident Commander for high-severity/major incidents, directing cross-functional response and briefing the Director and executive stakeholders.
• Champion automation and orchestration (SOAR, workflow tooling, scripting) across cyber defense operations to reduce manual effort and scale capabilities.
• Own operational performance and reporting for CSOC, Incident Response, and Insider Threat; contribute to enterprise-wide detection and response metrics in coordination with Threat Intelligence, Threat Hunting, and Detection Engineering.
• Provide strategic oversight of the Insider Threat and Data Loss Prevention (DLP) programs to reduce risks associated with unauthorized access, misuse of sensitive information, and data exfiltration.
• Establish, monitor, and report on key cyber defense metrics including alert volumes, detection coverage, response effectiveness, mean time to detect (MTTD), mean time to respond (MTTR), threat intelligence effectiveness, DLP investigations, insider threat investigations, and operational maturity.
• Support the evolution of integrated cyber defense capabilities through collaboration among Cyber Threat Intelligence, Threat Hunting, Detection Engineering, Protection Engineering, CSOC, Incident Response, and Insider Threat teams.
• Partner with Cyber senior leadership to direct business and financial resources effectively based on risk assessments, threat landscape changes, and strategic priorities.
• Monitor and review the effectiveness of risk measurement strategies, updating procedures and controls in partnership with Technology Risk Management and Enterprise Risk teams while communicating cyber risk posture to senior leadership.
• Represent the organization in regulatory examinations, industry forums, audits, and cybersecurity engagements involving security operations, cyber resilience, and incident response practices.
• Create a strong workforce plan to meet business needs, including mentoring and coaching cybersecurity leaders, succession planning, workforce development, skills assessments, and cultivating a culture of accountability, innovation, resilience, and continuous learning.
• Exercise usual authority of a manager concerning staffing, performance appraisals, promotions, salary recommendations, performance management, and terminations.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
• Design, implement, maintain, and enhance internal controls to mitigate risk on an ongoing basis.
• Identify risk-related issues needing escalation to management.
• Promote an environment that supports belonging and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit findings together with any issues raised by regulators as applicable.
• Complete other related duties as assigned.

Scope of Responsibilities

• Primary partners: Director of Cybersecurity Operations, Chief Information Security Officer (CISO), Chief Information Officer (CIO), Cybersecurity Leadership Team, Technology Directors, Enterprise Architecture, Technology Risk Management, Corporate Security, Legal, Compliance, Internal Audit, and Enterprise Resilience leaders.
• Stakeholders: Regulators, Technology teams, Risk teams, Corporate Security, Business leaders, Audit partners, customers, and the Bank.
• Work is accomplished with minimal direction; strategizes team imperatives in alignment with Bank imperatives.
• Oversees 2 or more functions/teams or a department within Cybersecurity.
• This role may act as a lead Cybersecurity representative with Regulators.
• Accountable for developing and executing budget for functions/teams they oversee.
• This role manages one or more functions/teams/departments within Cybersecurity: Operations and Threat – proactively identify, analyze, and respond to cyber threats, ensuring the Bank's digital assets are secure and resilient against potential risks and attacks.
• Functions/teams may include Cybersecurity Operations Center (CSOC), Incident Response, Threat Intelligence, Threat Hunt, Threat Detection Engineering, SOAR, Insider Threat, Cyber Fusion Center Operations, Governance and Operation Metrics, and Operational Resilience & Crisis Response.

Education and Experience Required

• Bachelor's degree and a minimum of 9 years’ relevant work experience, or in lieu of a degree, a combined minimum of 13 years’ higher education and/or work experience.
• Demonstrated expert knowledge of Cybersecurity principles.
• Minimum of 8 years’ work experience in/with the specific cybersecurity function.
• Minimum 3 years’ managerial experience.

Education and Experience Preferred

• Experience leading enterprise Security Operations Center (SOC/CSOC) organizations within a large, highly regulated financial institution.
• Experience overseeing Incident Response, Threat Intelligence, Threat Hunting, Detection Engineering, Insider Threat, and Data Loss Prevention programs.
• Deep understanding of threat-informed defense methodologies, ransomware preparedness, and cyber resilience principles.
• Experience with SIEM, SOAR, EDR, NDR, threat intelligence platforms, and advanced cybersecurity analytics technologies.
• Experience supporting regulatory examinations, audit engagements, and cyber resilience reviews.
• Demonstrated success leading cybersecurity transformation initiatives involving automation, AI-enabled operations, and operational excellence.
• Proven ability to build and lead high-performing cybersecurity organizations through periods of growth, modernization, and change.

M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $167,600.00 - $279,400.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation.

Location Buffalo, New York, United States of America

Great companies have an enduring sense of purpose. At M&T, our purpose is a simple one: make a difference in people’s lives and uplift the communities we serve.

M&T Bank Corporation is a financial holding company headquartered in Buffalo, New York. M&T’s affiliates offer advice, guidance, expertise and solutions across the entire financial spectrum, combining M&T Bank’s traditional banking services with the wealth management and institutional capabilities offered by Wilmington Trust.

M&T Bank has a network of over 1,000 branches and 2,200 ATMs that span 12 states from Maine to Virginia and Washington, D.C. For more than 165 years, M&T has strived to take an active role in our communities and build long-lasting relationships with our customers.

We are a bank for communities—combining the capabilities of a large bank with the care of a locally focused institution.

As an employer of choice, we are proud to offer competitive benefits ranging from medical and retirement to forty hours of paid volunteer time, each year.

Our core values – integrity, ownership, collaboration, curiosity, and candor – drive the work we do.

We seek to further build upon our record of success by bringing in top talent and fresh skill sets while continuing to support the growth and development of all our team members.

M&T Bank is unwavering when it comes to providing equal employment opportunities to all employees and applicants without regard to race, color, national origin, religion, ethnicity, sex, gender identity, age, disability, citizenship, pregnancy, veteran status, military status, marital status, sexual orientation, genetic information or any other characteristic protected under applicable federal, state or local laws.

M&T Bank Corporation has policies and procedures in place to promote a drug free workplace.