Director Of Security Operations

## Director Of Security Operations Apply:
Hybrid:
OH
- Columbus
- Dublin:
OH
- Cleveland:
Full time:
Posted Yesterday:
REQ
2445

As BWE’s Director of Security Operations (Sec Ops), you are the senior hands-on security expert accountable for the engineering and operational effectiveness of BWE’s security program. You lead a three-person security team as a player-coach, staying deep in the technology yourself, leading incident response, tuning platforms, and making the technical calls. You protect an environment of over 600 users, 700 endpoints, and 30 office locations across a best-of-breed security stack layered over Microsoft 365 and Azure and delivered with an MDR partner, in a regulated commercial real estate finance business examined by GSEs, rating agencies, and clients.
*
* Primary Responsibilities:

*
* ● Team Leadership:
Lead a team of three security professionals as an active technical contributor, setting standards, reviewing work directly, coaching, and stepping into complex technical issues.
● Security Engineering:
Own, configure, tune, and troubleshoot BWE’s security stack, taking platforms beyond implementation into measurable coverage and enforced controls.
● Platform Rationalization:
Evaluate the security tool portfolio for coverage, overlap, and cost, and recommend consolidation or retirement.
● Detection and Response:
Own detection and response outcomes, including alert quality, tuning, escalation, and vendor accountability.
● Detection Engineering:
Set detection, logging, and telemetry standards across cloud, SaaS, endpoint, identity, and data platforms, and turn threat intelligence into actionable detections and hunts.
● Incident Command:
Serve as security incident commander from triage through recovery and post-incident review, building and rehearsing playbooks and taking part in the security on-call rotation.
● Vulnerability Management:
Drive vulnerability management from discovery and prioritization through remediation and verification, supported by asset inventory and attack surface management.
● Security Architecture:
Set security architecture standards for cloud, SaaS, infrastructure, applications, and data platforms, and define security-by-design requirements for new technology.
● Data Protection:
Implement and operate data protection controls for confidential financial information, including classification, encryption, retention enforcement, and data loss monitoring.
● Application Security:
Maintain secure SDLC practices for internally developed applications, including code scanning standards, software supply chain security, and application security assessments.
● Vendor Security:
Assess and monitor the security of third parties based on the sensitivity of the data and access involved, including due diligence and contractual security requirements.
● Cyber Risk Assessment:
Lead cyber risk assessment activities, including penetration tests, tabletop exercises, CIS control and identity reviews, and social engineering, driving findings to closure.
● Security Governance:
Partner with the Chief Digital Officer and Compliance on information security policies and standards, and own the technical standards and procedures that implement them.
● Control Framework Alignment:
Maintain BWE’s alignment to NIST CSF and CIS Controls, including periodic maturity assessment and tracking of control gaps to closure.
● Audit Response:
Implement, operate, and evidence technical controls for Fannie Mae, Freddie Mac, HUD and FHA, rating agency, and client security requirements and examinations.
● Security Automation:
Use scripting, APIs, playbooks, and AI to automate detection, response, investigation, and reporting, reducing manual effort across security operations.
● Cyber Resilience:
Partner with Technology…