Security Operations & Engineering Lead; Brea​/Irvine, CA)

Position: Envista Security Operations & Engineering Lead (Brea/Irvine, CA)
Job Description:

JOB SUMMARY:

Must reside within a commutable distance to both Brea, CA and Irvine, CA, as the office location will be relocated from Brea to Irvine in approximately Q1 2028. This is not a hybrid or remote opportunity and requires onsite presence 4 days per week.

We are seeking a strategic and hands-on Security Operations and Engineering Lead to serve as Envista’s senior technical expert for security operations, detection engineering, incident response, and security platform capabilities. Operating with a high degree of autonomy, this role translates the Global Head of Information Security & GRC’s direction into scalable capabilities, operating models, roadmaps, and measurable outcomes.

This leader provides domain leadership for the SOC, incident response program, detection lifecycle, and security tooling ecosystem and is responsible for building scalable, threat-informed, and measurable security operations. The role shapes direction within the Security Operations & Engineering domain, recommends priorities and investments, and influences enterprise decisions through technical expertise, while final accountability for Envista’s overall cybersecurity strategy remains with the Global Head of Information Security & GRC.

PRIMARY DUTIES AND RESPONSIBILITIES:

Security Operations Leadership Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.

Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes.

Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and the cybersecurity strategy established by the Global Head of Information Security & GRC.Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness.

Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap for approval by the Global Head of Information Security & GRC.Security Engineering & Platform Management Develop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms.

Drive automation across triage, enrichment, containment, and reporting workflows.

Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities across the enterprise.

Define enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standards.

Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement based on enterprise risk, business value, and alignment with cybersecurity priorities.

Incident Response & Threat Management Provide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications, within the governance and escalation framework established by the Global Head of Information Security & GRC.Serve as the senior operational and technical lead for major incidents, directing containment, eradication, recovery, and root cause analysis and advising executive leadership on response options and business implications.

Ensure post-incident reviews drive durable control improvements

Develop response strategies for novel or unprecedented cybersecurity events where established playbooks are insufficient.

Coordinate with Legal, Privacy, HR, IT, and Communications Detection Engineering & Monitoring Build detection engineering lifecycle: hypothesis development testing tuning deployment validation retirement.

Develop…