Lead Security Operations & CSIRT (Hybrid/Remote)

Genworth; Virginia; Hybrid; USD 121,000 - 187,000; Full time

Benefits offered by this job

Healthcare Coverage

401(k) Savings Plan Options

Employer-funded retirement feature

Job summary

Genworth is seeking a Lead, Security Operations to helm the CSIRT and coordinate enterprise cybersecurity incident responses across the organization. You will guide preparation, detection engineering, investigation, containment, recovery, and lessons learned to minimize disruption and strengthen resilience.

You will develop team capabilities, maintain response playbooks, and ensure clear ownership and timely escalation.

Qualifications

• Bachelor’s degree in cybersecurity, CS, IT, or equivalent experience.
• 7+ years in cybersecurity operations with CSIRT leadership.
• Proven ability to coordinate incidents across technical and business stakeholders.
• Experience with incident investigations and post‑incident reviews.

Responsibilities

• Lead CSIRT and set priorities for incident readiness and response.
• Direct end-to-end incident handling from triage to post‑incident review.
• Coordinate cross‑functional response with Cybersecurity, Tech, and external partners.
• Maintain and improve incident response plans, playbooks, and escalation criteria.
• Serve as primary escalation point for major incidents to leadership.
• Collaborate with Legal, Privacy, Compliance, Risk, and Communications on decisions.
• Guide investigations, preserve evidence, and coordinate external providers as needed.
• Lead tabletop exercises to test readiness and address gaps.

Skills

CSIRT leadership

Incident response

Strategic communication

Cross-functional collaboration

Regulatory compliance awareness

Mentoring & development

Education

Bachelor’s degree in Cybersecurity, CS, IT, or related field

Tools

SIEM

EDR

SOAR

Forensics tools

Job description

Genworth is seeking a Lead, Security Operations to helm the CSIRT and coordinate enterprise cybersecurity incident responses across the organization. You will guide preparation, detection engineering, investigation, containment, recovery, and lessons learned to minimize disruption and strengthen resilience.

You will develop team capabilities, maintain response playbooks, and ensure clear ownership and timely escalation.