Global IT Security Operations & Exposure Management Lead; Remote

The IT Global Security Operations & Exposure Management Lead is a hands-on operational leader responsible for building and running a scalable global security operations capability. Reporting to the CISO, this role owns the effectiveness of security monitoring, incident response, security ticket operations, detection engineering, third-party security service delivery, and the operating cadence that drives exposure to closure. The role will lead and develop internal staff as the function grows;

partner closely with IT, engineering, manufacturing, and business service owners; and strengthen protection of intellectual property, manufacturing uptime, and digital modernization across legacy, cloud, and operational environments.

• Own daily security operations service delivery, including security ticket intake, triage, prioritization, escalation, case quality, and closure discipline
• Manage the performance of managed security service providers and other third-party security services, defining expectations, reviewing metrics, challenging quality, and driving corrective actions
• Establish and maintain severity definitions, investigation standards, escalation paths, response playbooks, and executive notification criteria
• Report operational health and risk to the CISO using clear measures of coverage, detection quality, response performance, backlog, and remediation progress
• Build the operating model and talent roadmap for a scalable global security operations function
• Promote a supportive, performance-oriented culture of velocity, integrity, and teamwork

• Lead enterprise-wide security operations and incident response, including detection, triage, containment coordination, eradication support, coordination of root‑cause analysis, and post‑incident review
• Own incident lifecycle discipline: case documentation, evidence preservation, lessons learned, corrective actions, and closure validation
• Lead incident tabletop exercises and coordinate security participation in recovery readiness for manufacturing, engineering, and corporate environments
• Partner with accountable IT, engineering, manufacturing, and business service owners to ensure timely remediation; infrastructure and business service owners retain accountability for recovery implementation

• Establish the operational cadence that converts vulnerability, asset, identity, cloud, and threat findings into prioritized remediation actions
• Partner with team members on asset coverage, vulnerability intelligence, OT/IT segmentation, and technical risk analysis, maintaining clear boundaries for analysis and operational activities
• Track remediation commitments, challenge overdue high‑risk items, and escalation unresolved exposure to the appropriate leaders
• Ensure security monitoring and response requirements are incorporated into major IT, cloud, engineering, and manufacturing initiatives

• Translate CISO strategy into operational capability: telemetry standards, coverage models, automation pipelines
• Define and continuously improve detection use cases based on threats, business‑critical services, and available telemetry
• Improve detection fidelity through tuning, enrichment, automation, and documented use‑case lifecycle management
• Leverage approved AI‑enabled capabilities and automation to improve detection quality, reduce false positives, accelerate investigation and response, strengthen case documentation, and identify meaningful opportunities to mature security operations using appropriate human validation, access controls, and data handling safeguards
• Define…