Sr. Director, Cyber Security

Upbound Group Inc.; Plano (TX); On-site; USD 180,000 - 250,000; Full time

Job summary

Upbound Group Inc. is seeking a Sr. Director of Cyber Security to lead the cyber defense program, including security operations, incident response, threat hunting, and exposure management.

You will govern vulnerability management, PCI DSS alignment, and AI governance while acting as a deputy to the CISO and shaping the security strategy. The role requires deep leadership, 15+ years in cybersecurity, and experience with major incidents in consumer finance or retail contexts.

Qualifications

• 15+ years in cybersecurity, with senior governance and operations experience.
• 8+ years in people management and leadership of security teams.
• Led major incident responses with executive briefing experience.
• Managed a scalable vulnerability management program with SLAs and audits.
• Established risk governance with risk registers and reporting to executives and boards.
• Built or rebuilt detection engineering and managed outsourced detection/response partners.
• Applied AI and automation to security operations and governed AI risk.

Responsibilities

• Own security operations center performance and monitoring SLAs.
• Lead end‑to‑end incident response with playbooks and executive updates.
• Oversee detection engineering and threat hunting aligned to attacker techniques.
• Manage exposure inventory, risk prioritization, and remediation tracking.
• Govern vulnerability management, SLAs by risk tier, and audit evidence.
• Govern AI risk, approvals, and reporting to governance forums.
• Maintain a risk‑driven defense backlog with clear ownership and dates.
• Scale team with AI‑assisted triage and automation, and manage external partners.
• Hire, develop, and lead the security team and contract engineers.

Skills

Cybersecurity leadership

Security operations

Exposure management

Incident response

Threat hunting

Detections engineering

AI governance

Risk governance

Team leadership

Vendor management

Education

CISSP or equivalent certification

Job description

Sr. Director, Cyber Security (Head of Cyber Defense)

Who We Are

At Upbound Group, we are committed to elevating financial opportunity for all through innovative, inclusive, and technology‑driven financial solutions that address the evolving needs and aspirations of consumers. The Company’s customer‑facing operating units include industry‑leading brands such as Rent‑A‑Center, Acima and Brigit that facilitate consumer transactions across a wide range of store‑based and digital retail channels, including over 2,400 company‑branded retail units across the United States, Mexico, New York and Puerto Rico. Upbound Group, Inc. is headquartered in Plano, Texas.

Role Summary

You’ll lead cyber defense for Upbound: security operations, incident response, threat hunting, detection engineering, and exposure management. You also own the governance that keeps defense risk‑driven: the vulnerability management standard and its SLAs, risk acceptance and exceptions, the security program’s oversight of AI risk, and the measures we report to the CISO and the board committee. You own how fast we detect, contain, recover, and close exposures, and you leverage AI to scale the team and increase the pace of everything it does. If we bring the right talent, this role is a deputy for the CISO and part of succession.

Key Responsibilities

• Own the security operations center and the managed monitoring partner’s service levels.
• Run incident response end‑to‑end, from incident command to executive updates, with playbooks so every incident runs to a script.
• Own detection engineering and threat hunting: detections as code, mapped to the attacker techniques that matter to us and measured for coverage, and hunting as a standing practice.
• Own exposure management end‑to‑end through the Principal, Exposure Management: the asset and exposure inventory, prioritization by risk, closure SLAs, and verified fixes with the platform and application owners.
• Own vulnerability management governance: the standard, the SLAs by risk tier, risk acceptance and exceptions, and the evidence for PCI DSS, audits, and regulators.
• Manage AI governance for the security program: risk assessment of new AI use, the approval and exception path, and the program’s reporting into the company’s AI governance forum, with the Head of AI Security setting the technical standards.
• Run the defense risk register: turn findings from incidents, audits, assessments, and penetration tests into one risk‑driven backlog with owners and dates, hold them, and report the measures to the CISO and the board committee: time to detect, time to contain, time to recover, exposures closed within SLA, and risk accepted.
• Leverage AI to scale and increase the pace of defense: AI‑assisted triage and investigation, agentic response with approval gates, and automation of the routine work so the team hunts and engineers.
• Hire, develop, and lead the team and direct the contract engineers who augment it.

Qualifications

• More than fifteen years in cybersecurity, with ten or more spanning security governance, security operations, and exposure management.
• More than eight years of people management.
• You’ve led response through major incidents, including incident command and briefing executives.
• You’ve owned a vulnerability management program at scale: the standard, the SLAs, the exception process, and the evidence auditors and assessors asked for.
• You’ve run risk governance for a security program: a risk register, risk acceptance, and reporting to executives and a board committee, without slowing the business down.
• You’ve built or rebuilt detection engineering and managed an outsourced detection and response partner.
• You’ve put AI and automation to work in security operations and can show what it changed, and you’re comfortable governing AI risk as the business adopts it.
• Comfortable with PCI DSS and the regulatory environment of consumer finance.
• Retail or consumer finance. CISSP, CISM, GCIH, GCFA, or similar, preferred.
• undefined

Work Location

Ability to work in the Plano, Texas Monday through Friday, with travel between locations as necessary based on transformation and governance activities.

Employment Eligibility

To be eligible for this opportunity, you must be authorized to work in the U.S. Upbound Group does not offer employment‑based immigration sponsorship for this role, including OPT or CPT.

Equal Opportunity Employer

Upbound Group is an equal opportunity employer committed to ensuring all employment decisions are made on a non‑discriminatory basis in accordance with applicable federal, state, and local laws.