Senior Director, SOC Operations & Threat Detection

CVS Health; Phoenix (AZ); On-site; USD 144,000 - 288,000; Full time

Job summary

CVS Health is seeking a Lead Director - Security Operations Center to guide the cybersecurity operations for a fast-evolving healthcare business, ensuring detection, investigation, response and recovery from threats.

You will establish processes, metrics, and threat intelligence; lead a high‑performing team; and collaborate with cloud, network, and engineering teams to strengthen security posture across critical systems and services.

Qualifications

• 10+ years of cybersecurity experience in large-scale environments.
• 5+ years leading Security Operations Center (SOC), Incident Response, Cyber Defense, or Threat Detection teams.
• 5+ years operating and optimizing enterprise security platforms including SIEM, EDR/XDR, SOAR, and security automation technologies such as Microsoft Sentinel, CrowdStrike Falcon, and Wirespeed.
• 3+ years building, managing, and maturing security operations capabilities, including monitoring, threat hunting, incident response, digital forensics, and investigations.

Responsibilities

• Lead the strategy, execution, and continuous improvement of the Security Operations Center, including threat monitoring, detection, investigation, response, and threat hunting.
• Establish operational processes, service levels, metrics, and reporting to measure effectiveness and support informed decision-making.
• Build and mature SOC capabilities aligned to business priorities, risk tolerance, and growth objectives.
• Coordinate response efforts during incidents and provide escalation as the primary point of contact.

Skills

SOC leadership

Threat detection

Incident response

Security operations

SIEM

EDR/XDR

SOAR

Automation/AI in security

Threat intelligence

Cloud security

Education

Bachelor's degree in Cybersecurity, IT, CS, Engineering, or related field

Tools

Microsoft Sentinel

CrowdStrike Falcon

Wirespeed

Job description

CVS Health is seeking a Lead Director - Security Operations Center to guide the cybersecurity operations for a fast-evolving healthcare business, ensuring detection, investigation, response and recovery from threats.

You will establish processes, metrics, and threat intelligence; lead a high‑performing team; and collaborate with cloud, network, and engineering teams to strengthen security posture across critical systems and services.