Security Operations Leader: Detection & Incident Response

Envista; Brea (CA); On-site; USD 156,000 - 191,000; Full time

Benefits offered by this job

Health & Wellbeing

Retirement & Financial Benefits

Life & Disability Insurance

Paid Time Off

Learning & Career Development

Job summary

Envista seeks a strategic Security Operations and Engineering Lead to drive enterprise cybersecurity operations, detection engineering, and incident response. This onsite role manages the SOC, IAM, and security tooling, coordinating with MSSP/MDR partners and cross-functional teams.

The position requires guiding a threat-informed security program, building scalable detections, and leading incidents from containment to lessons learned. Relocation to Irvine/Brea area anticipated, 4 days onsite.

Qualifications

• 7+ years of experience in cybersecurity, security operations, detection engineering, or incident response.
• 5+ years leading security operations, engineering, SOC, or incident response teams.
• Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments.
• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle).
• Experience in Azure, AWS, or GCP environments.
• Ability to communicate technical risks to executive leadership and business stakeholders.

Responsibilities

• Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.
• Oversee SOC and MSSP/MDR partnerships with SLAs, alert quality, escalation paths, and metrics.
• Define KPIs/KRIs including MTTD, MTTR, alert fidelity, and detection coverage.
• Lead lifecycle management of SIEM, SOAR, EDR/XDR, CSPM, DLP, identity, and cloud platforms.
• Coordinate major incidents through containment, eradication, and recovery with post-incident reviews.
• Build detection engineering lifecycle: hypothesis testing, tuning, deployment, and retirement.
• Partner with Legal, Privacy, HR, IT, and Communications for incident handling and governance.
• Drive automation across triage, enrichment, containment, and reporting workflows.

Skills

Security leadership

Security operations management

Incident response coordination

Threat detection engineering

MITRE ATT&CK approach

Cloud security

Education

Bachelor's degree in Information Security, Cybersecurity, CS, IS, Business, Engineering, or related field

Tools

Microsoft Sentinel

Splunk

QRadar

Chronicle

EDR/XDR tooling

Job description

Envista seeks a strategic Security Operations and Engineering Lead to drive enterprise cybersecurity operations, detection engineering, and incident response. This onsite role manages the SOC, IAM, and security tooling, coordinating with MSSP/MDR partners and cross-functional teams.

The position requires guiding a threat-informed security program, building scalable detections, and leading incidents from containment to lessons learned. Relocation to Irvine/Brea area anticipated, 4 days onsite.