IT Cyber Defense Lead (Hybrid Office Schedule)

AFL; South Carolina; Hybride; USD 120 000 - 170 000; Plein temps

Avantages offerts par ce poste

Hybrid in-office schedule

401K match

Tuition reimbursement

Medical, dental, vision insurance

Career advancement opportunities

Résumé du poste

AFL is seeking a Cyber Defense Lead to head security operations, threat monitoring, investigation, and response across a global IT landscape. You will own the security stack, govern a managed detection service, and lead incident response for high-severity events.

The role also sets technical direction for threat detection and response. Based in Duncan, SC with hybrid scheduling, you will mentor others, build runbooks, and drive automation across detection, response, and service management

Qualifications

• Bachelor's degree in computer science, information technology, cybersecurity or equivalent.
• Five+ years in security operations, with three+ in senior roles.
• Hands-on administration of enterprise EDR (CrowdStrike Falcon preferred).
• IR experience on business-impacting incidents: containment and post-incident reviews.
• Fluent in query languages for security analytics and log onboarding.
• Experience tuning detection content using production telemetry.
• Knowledge of MITRE ATT&CK for coverage decisions, not just terminology.
• Clear written and verbal communication with technical and leadership teams.

Responsabilités

• Own admin, tuning, and roadmap for endpoint detection, identity protection, and security analytics.
• Act as incident commander for high-severity security events and drive post-incident actions.
• Govern the managed detection and response provider relationship and reviews.
• Define agent scope, guardrails, and human gates; measure autonomous accuracy.
• Develop and refine detection content mapped to MITRE ATT&CK.

Connaissances

Security operations

Incident response

MITRE ATT&CK

CrowdStrike Falcon

Log onboarding

Query language

Automation playbooks

Formation

Bachelor’s degree in CS/IT/Cybersecurity

Outils

CrowdStrike Falcon

Security analytics platforms

Description du poste

Job Category: IT - Security

Requisition Number: ITCYB009383

• Full-Time
• Hybrid

Locations

Duncan, SC 29334, USA

Description

AFL manufactures industry-leading fiber optic cable, connectivity and accessories and provides engineering and installation services for some of the largest telecom customers in the world. Our company was founded in 1984 with a single fiber optic cable and today, we manufacture thousands of products, generate an excess of $4B in revenue, and employ approximately 12,000 associates worldwide. At AFL, we recognize that our employees are our greatest asset. We hire and train each individual, investing in them to ensure success in their careers. With a commitment to professional development and growth, let us connect you to your next career opportunity.

What We Offer

• A hybrid in office schedule for qualifying employees
• Flexible time off policy
• 401K Company match (up to 4% - dollar for dollar)
• Professional development, training, and tuition reimbursement programs
• Excellent medical, dental, vision, and life insurance policy options
• Opportunities for career advancement with an industry leading company!

We are seeking a Cyber Defense Lead to join our global IT organization in Duncan, SC. Under general direction, this role leads security operations covering threat monitoring, investigation, and response across AFL’s global organization. The incumbent owns the security platform stack, governs the managed detection and response provider, and serves as incident commander during high severity events. This role works independently and sets the technical direction for how AFL detects and responds to threats.

Responsibilities

• Own administration, tuning, and roadmap for the endpoint detection, identity protection, and security analytics platform stack, including log source onboarding and telemetry coverage.
• Serve as incident commander for high severity security events. Coordinate technical response, containment decisions, and business communication. Run post-incident reviews and drive corrective actions to closure.
• Govern the managed detection and response provider relationship. Review escalation quality, response times, and handoff accuracy in recurring service reviews.
• Own the agentic triage and case management capability. Define agent scope, guardrails, and human approval gates, and measure autonomous accuracy before expanding autonomy.
• Maintain and improve detection content. Write new detections, tune noisy ones, and map coverage to MITRE ATT&CK to identify and close gaps.
• Develop automation playbooks and API integrations across detection, response, and service management platforms to reduce analyst touch time.
• Operationalize threat intelligence and conduct proactive threat hunts against defined hypotheses.
• Define and report security operations metrics, including mean time to detect, mean time to respond, escalation volume, false positive rate, and detection coverage.
• Build and maintain runbooks, severity criteria, escalation paths, and on-call procedures. Contribute to incident response tabletop exercises and business resiliency planning.
• Partner with Systems, Network, and Application teams on control gaps surfaced during investigations, and support incident documentation for audit, cyber insurance, and customer assessments.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity or equivalent work experience required.
• Five or more years in security operations, with three or more in a senior or lead capacity.
• Hands-on administration of an endpoint detection and response platform at enterprise scale. CrowdStrike Falcon preferred.
• Hands-on incident response experience on business-impacting events, including containment, investigation, and post-incident review.
• Query language fluency for security analytics platforms, plus log source onboarding experience.
• Experience building or tuning detection content against production telemetry.
• Working knowledge of MITRE ATT&CK applied to coverage decisions, not just terminology.
• Clear written and verbal communication with technical staff and business leadership.
• One or more of the following certifications preferred but not required: CISSP, CISM, GCIA, GCIH, GCFA, GDAT, GCDA or vendor certifications for the deployed security platforms.

Personal Qualities

• Stays composed under pressure and makes sound containment decisions with incomplete information.
• Takes ownership of problems and follows them to resolution without prompting.Validates output from vendors, tools, and automation before acting on it.
• Builds working relationships with both technical and non-technical teams outside the security function.
• Communicates clearly, translating technical findings for engineers and for business leadership.

Working Conditions

• Hybrid schedule based onsite in Duncan, SC.
• Carries on-call responsibility. Requires availability outside standard business hours during active security incidents, which occur without notice and may extend across consecutive days.
• Standard office environment. Occasional access to manufacturing floors where hearing protection and personal protective equipment are required.
• Flexibility travel to AFL domestic and international sites if needed.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.