Global Cybersecurity Director - Security Operations

Position: Global Cybersecurity Director -  Security Operations
Location: Wood Green

Who We Are
Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.
To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.

What You'll Do
Security Continuous Monitoring Oversight

* Establish and lead BCG’s first enterprise-wide Cybersecurity Continuous Monitoring (CSCM) program, ensuring continuous visibility into system, endpoint, network, and cloud activity.

* Define and implement governance models, including ownership of monitoring metrics (e.g., MTTD, MTTR, false positive rate, coverage completeness).

* Stand up monitoring processes and integrate telemetry sources across SIEM, EDR, identity, network, and cloud platforms.

* Ensure monitoring outputs are actionable, enriching detection and response activities and informing risk and compliance stakeholders.
Technical Architecture & Integration

* Design and implement a continuous monitoring reference architecture, leveraging SIEM, SOAR, UEBA, and threat intelligence.

* Establish enterprise logging standards covering log coverage, retention, encryption, access, and integrity requirements.

* Drive automation of monitoring workflows and correlation logic to reduce dwell time and improve detection accuracy.

* Collaborate with threat intelligence teams to ensure real-time enrichment of event data and alignment with MITRE ATT&CK adversary tactics.
Program & Capability Development

* Build the CCM capability from the ground up, defining the operating model, reporting cadence, and engagement with SOC, risk, and compliance.

* Develop and track KPIs, ensuring CCM effectiveness is measurable and communicated to senior stakeholders.

* Prioritize creation of top 5–10 operational dashboards and reports that provide critical enterprise visibility.

* Mature the function from initial operational capability (M1) toward advanced maturity, embedding continuous improvement cycles.
STRATEGIC LEADERSHIP

* Serve as the founding leader for the CCM function, creating the strategy, roadmap, and tactical build plan.

* Partner with enterprise stakeholders across IT, Risk, and Security to align monitoring with business risk tolerance and resilience objectives.

* Influence senior leaders by translating technical telemetry insights into business-relevant intelligence.

* Build, inspire, and retain a high-performing team of analysts and engineers over time, leveraging both full-time staff and contractors.

* Advise senior leadership (via SecOPS) on monitoring-driven insights, risks, and mitigation recommendations.

What You'll Bring

* Bachelor’s degree (or equivalent). Master’s preferred.

* 10+ years in cybersecurity operations, with at least 5 years in security monitoring, SOC leadership, or equivalent detection & response functions.

* Proven track record of building or maturing monitoring capabilities (SIEM, SOAR, telemetry pipelines, UEBA, threat intel integration).

* Knowledge of log ingestion, normalization, correlation, and enrichment processes.

* Familiarity with leading monitoring technologies: Splunk, Data Dog, Microsoft Defender, Crowd Strike Falcon, Azure/AWS/GCP telemetry, threat intelligence platforms.

* Expertise in metrics-driven monitoring: defining, tracking, and reporting MTTD, MTTR, false positive rates, and coverage completeness.

* Familiarity with frameworks like NIST CSF, MITRE ATT&CK, and ISO 27001, with experience applying these to monitoring.

* Experience in threat hunting, anomaly detection, and behavioral…