Cyber Defense & Data Security Lead - Americas Raleigh, NC,

Position: Cyber Defense & Data Security Lead - Americas Raleigh, NC, US + 1 more
## Cyber Defense & Data Security Lead - Americas Raleigh, NC, United States##

Role Description

Location:

Raleigh/hybrid

The Cyber Defense & Data security Lead (Americas) is accountable for regional cyber defense operations across North and South America, with the primary goal to detect, prevent, and minimize business impacting security threats and events. This role leads day to day execution of 24x7 security operations, including incident response and incident management, threat intelligence, threat hunting focused on security and resilience and data loss prevention (DLP) response and engineering.
This role also provides operational coverage for U.S. Government regulated environments and business, including CMMC aligned environments and customer requirements. The technical leader ensures incidents, investigations, and evidence handling are executed in a defensible manner, supporting audit readiness, customer reporting, and contractual obligations.
The role operates in service to the enterprise and Operating Companies (OpCos), ensuring consistent operational outcomes while adapting execution to regional realities. The Americas Cyber Defense Lead partners closely with global Security Operations leadership, Cyber Defense Engineering, GRC, Audit, corporate IT shared services, Infrastructure and Cloud engineering, Identity teams, and engages Legal, HR, Privacy, and business leaders as required.
The role embraces the Ralliant Business System (RBS) by embedding operational discipline, staff training, and continuous improvement into tools, workflows, and standard work so cyber defense is scalable, measurable, and repeatable. The role partners with technical and engineering teams to enhance resilience by reducing recurring operational weaknesses, improving recovery readiness, and strengthening controls that prevent repeat business disruption.##

Key Responsibilities
* Lead Americas execution of 24x7 SOC operations, including monitoring, triage, case management, shift handoffs, and escalation to ensure reliable regional coverage and consistent outcomes.
* Direct incident response execution and incident management for the Americas, including containment coordination, recovery support, stakeholder communications, and post incident reviews with tracked corrective actions.
* Serve as incident commander for assigned events, driving rapid decision making, operational tempo, and clear executive ready updates focused on business impact and risk.
* Provide operational oversight for U.S. Government and CMMC aligned environments, including incident handling expectations, evidence collection standards, and escalation pathways that support contractual and regulatory obligations.
* Lead DLP response operations and engineering, including alert triage, investigation workflows, escalation criteria, documentation standards, and partnership with Legal, HR, and Privacy for sensitive cases.
* Partner with Cyber Defense Engineering to improve detection coverage and fidelity across endpoint, identity, cloud, SaaS, email, and network telemetry, including tuning to reduce false positives and increase high confidence detections.
* Operationalize threat intelligence by translating external and internal signals into prioritized detections, hunts, response actions, and targeted advisories for technical and business stakeholders.
* Lead threat hunting focused on both security and resilience, identifying control gaps, validating defensive assumptions, and improving readiness for high impact scenarios.
* Participate in exposure management response with technology owners, driving risk based prioritization, remediation execution, exception handling, and transparent reporting tied to business criticality.
* Maintain regional metrics and reporting, including time to detect, time to contain, incident trends, alert quality, exposure remediation progress, and recurring driver analysis, using insights to drive measurable improvement.
* Train and coach staff through playbook walkthroughs, simulations, tabletop exercises, and after action reviews; reinforce disciplined execution and consistent decision making under pressure.
* Embed security operations…