Senior Director, Security Operations

Senior Director, Security Operations — Integrated Security Operations Center Location: Bengaluru, India Experience: Senior leadership Schedule: Core business hours with accountability for a 24x7 global operation About the role We are seeking a strategic, operationally rigorous Senior Director of Security Operations to lead our Integrated Security Operations Center (ISOC) in Bengaluru. You will set the vision, operating model, and performance standards for a high-performing 24x7 security operations function. You will be accountable for the organization’s ability to detect, investigate, contain, and recover from cyber threats—while building a scalable team, mature processes, and strong partnerships across Security, IT, Engineering, Risk, and the business. This role combines executive leadership with operational ownership. You will lead incident response readiness, detection strategy, threat intelligence, automation, and continuous improvement, ensuring security operations are both effective today and prepared for the organization’s future needs. What you’ll do Lead security operations Define and execute the strategy, operating model, and roadmap for the ISOC. Lead a 24x7 security operations team, including managers, analysts, incident responders, and specialized technical resources. Establish clear service levels, escalation paths, quality standards, staffing models, and shift-coverage practices. Ensure timely, consistent, and risk-based triage, investigation, containment, and recovery for security events and incidents. Build a culture of accountability, operational discipline, learning, and continuous improvement. Own incident readiness and response Provide leadership during significant security incidents, coordinating technical, business, legal, communications, and executive stakeholders as needed. Ensure incident response plans, playbooks, exercises, and communications processes are current, tested, and effective. Drive post-incident reviews that result in meaningful improvements to technology, processes, controls, and organizational readiness. Communicate material risks, incident status, and operational performance clearly to senior leadership. Advance detection, intelligence, and automation Set the strategy for detection engineering, threat intelligence, threat hunting, and security automation. Ensure detection coverage is aligned to the threat landscape, critical assets, business priorities, and frameworks such as MITRE ATT&CK. Oversee the development and tuning of use cases, rules, playbooks, and automation to improve detection quality and reduce response time. Establish metrics for detection efficacy, false-positive rates, incident lifecycle performance, coverage, and operational maturity. Partner with engineering and platform teams to improve telemetry, visibility, and security tooling. Build partnerships and scale capability Partner with IT, Engineering, Cloud, Identity, Legal, Risk, Privacy, and business leaders to integrate security operations into enterprise processes. Manage relationships with security vendors, managed service providers, and other external partners. Lead workforce planning, hiring, development, succession planning, and budget management for the function. Drive major programs such as new tool adoption, SIEM modernization, automation initiatives, cloud-security integration, and security operations maturity assessments. Present strategy, performance, risks, and investment needs to executive leadership. What you’ll bring Significant experience leading security operations, incident response, or cyber defense teams in a complex enterprise environment. Demonstrated success building, scaling, or transforming a security operations center or similar 24x7 function. Deep understanding of incident response, threat detection, SIEM, EDR, identity, cloud security, network security, and security automation. Experience leading high-severity incident response and communicating effectively with executives and cross-functional stakeholders. Strong operational leadership skills, including defining metrics, service levels, processes, staffing models, and improvement roadmaps. Experience developing leaders and building inclusive, high-performing technical teams. Ability to translate technical risk into clear business implications, priorities, and investment decisions. Strong written and verbal communication skills. Nice to have Experience leading global or multi-site security operations teams. Experience with cloud-native environments, large-scale identity ecosystems, or complex hybrid infrastructure. Familiarity with regulatory, privacy, audit, and third-party-risk requirements. Experience with SOAR, SIEM modernization, security data platforms, or AI-assisted security operations. Relevant certifications such as CISSP, CISM, GIAC, or cloud-security certifications. A degree in cybersecurity, computer science, business, or a related field—or equivalent leadership experience. How you’ll make an impact You will shape the future of security operations at a foundational moment for the ISOC. Your leadership will strengthen the organization’s ability to respond to threats, reduce operational risk, develop security talent, and build a mature, resilient, intelligence-driven security operations capability. Key Responsibilities Security Operations – Vulnerability Assessment: – Guides the execution of critical security testing and vulnerability assessments to identify, prioritize, and mitigate information security threats and vulnerabilities in software, networks, and systems. – Governs remediation processes of multiple functions to ensure appropriate identification, assignment, and timely remediation, providing strategic guidance as needed. – Develops the standards for documentation process and vulnerability advisory documents, governing the process to ensure alignment. – Develops policies and standards regarding teams subscribing to vulnerability feeds to ensure the vulnerability assessments identify issues and assure their remediation. Security Operations – Security Solutions and Programs: – Provides oversight on the creation and implementation of critical security solutions and drives the development of organizational security programs to mitigate security risks. – Governs the creation of remediation plans to address security risks, proactively engaging with process owners to monitor and ensure progress. Security Operations – Security Event Monitoring: – Defines and drives the organization's strategic security monitoring strategy, aligning it with industry best practices and emerging threats. – Presents comprehensive metrics and reports on detection gaps, coverage, and overall security posture to executive leadership. – Directs the overall management of security tools to ensure that they have access to real-time data. – Guides the performance and documentation of initial triage of security events for escalation to incident management. – Governs gap identification and resolution processes in the current security monitoring systems, driving innovations of solutions. Security Operations – Incident Management: – Guides the response to and investigation and triage of critical events and incidents, establishing and refining escalation processes and ensuring top-level resolution. – Governs documentation and analysis of security events and alerts and develops organizational strategies to address and mitigate future threats, while maintaining direct communication with executive leadership. – Directs data collection, preservation, log analysis, and highly complex forensic analysis of digital media. – Evaluates reporting of incident management and root cause analysis results, guiding Corrective and Preventative Actions (CAPA) processes. – Pro