Head of Cybersecurity Defense Operations

This role is four days onsite at our Seneca One Buffalo, NY location, with the flexibility to work from home one day per week Overview: M&T Bank is seeking a strategic and transformational cybersecurity leader to serve as Head of Cyber Defense Operations. This role is accountable for leading the Bank's enterprise cyber defense capabilities, ensuring the continuous identification, protection, detection, response, and recovery from cybersecurity threats impacting the Bank's technology assets, customers, colleagues, and operations.

The Cybersecurity Operations division serves as the focal point for M&T's 24x7x365 cyber defense mission and first-line cybersecurity response capabilities. The Head of Cyber Defense Operations will oversee multiple cyber defense functions and will work in close partnership with Threat Intelligence, Threat Hunt and Detection Engineering teams to ensure a unified, intelligence-driven cyber defense mission across the enterprise. This leader will partner closely with Technology, Enterprise Risk, Compliance, Audit, Corporate Security, and executive leadership to strengthen the Bank's cyber resilience and operational readiness in an increasingly complex threat landscape.

This leader plays a key role in executing enterprise-scale cybersecurity programs, contributes to the Bank's cybersecurity transformation initiatives, and leads managers and senior technical leaders across the cyber defense mission. Reporting to the Director of Cybersecurity Operations, the Senior Manager translates enterprise strategy into operational execution, ensuring the Bank's detection, response, and insider risk capabilities function as a single, integrated defense mission.

• Operational leadership and execution of the Bank's Cyber Defense Operations strategy and roadmap, ensuring alignment with Cybersecurity, Technology, Operational Resilience, and enterprise risk management objectives.
• Provide strategic oversight and leadership for enterprise cyber defense capabilities, including security monitoring, threat detection, incident response, threat intelligence, threat hunting, insider threat, data loss prevention, and cyber defense engineering functions.
• Direct the operations and continuous maturation of the Cybersecurity Operations Center (CSOC), ensuring effective monitoring, triage, response, escalation, and containment of cybersecurity events across the enterprise.
• Lead strategic initiatives to modernize cyber defense operations through automation, advanced analytics, threat-informed defense methodologies, AI-enabled capabilities, and operational efficiencies while maintaining or improving security outcomes.
• Provide executive oversight of the Bank's Cybersecurity Incident Response Team (CIRT), ensuring effective preparedness, incident handling, recovery, after-action reviews, and continuous improvement of incident response processes.
• Serve as (or designate) the Cyber Incident Commander for high-severity/major incidents, directing cross-functional response and briefing the Director and executive stakeholders.
• Champion automation and orchestration (SOAR, workflow tooling, scripting) across cyber defense operations to reduce manual effort and scale capabilities.
• Own operational performance and reporting for CSOC, Incident Response, and Insider Threat; contribute to enterprise-wide detection and response metrics in coordination with Threat Intelligence, Threat Hunting, and Detection Engineering.
• Provide strategic oversight of the Insider Threat and Data Loss Prevention (DLP) programs to reduce risks associated with unauthorized access, misuse of sensitive information, and data exfiltration.
• Establish, monitor, and report on key cyber defense metrics including alert volumes, detection coverage, response effectiveness, mean time to detect (MTTD), mean time to respond (MTTR), threat intelligence effectiveness, DLP investigations, insider threat investigations, and operational maturity.
• Support the evolution of integrated cyber defense capabilities through collaboration among Cyber Threat Intelligence, Threat Hunting, Detection Engineering, Protection Engineering, CSOC, Incident Response, and Insider Threat teams.
• Partner with Cyber senior leadership to direct business and financial resources effectively based on risk assessments, threat landscape changes, and strategic priorities.
• Monitor and review the effectiveness of risk measurement strategies, updating procedures and controls in partnership with Technology Risk…