Director I - Cybersecurity Operations & Incident Response

Anticipated End Date:

2026-09-30

Position Title:

Director I - Cybersecurity Operations & Incident Response

Job Description:

Director I - Cybersecurity Operations & Incident Response

Location: This role requires associates to be in-office 3 days per week, fostering collaboration and connectivity, while providing flexibility to support productivity and work-life balance. This approach combines structured office engagement with the autonomy of virtual work, promoting a dynamic and adaptable workplace. 

Please note that per our policy on hybrid/virtual work, candidates not within a reasonable commuting distance from the posting location(s) will not be considered for employment, unless an accommodation is granted as required by law.

The Director, Cybersecurity Operations & Incident Response is responsible for leading enterprise cybersecurity monitoring, security incident response, and investigative operations across Elevance Health. This role leads the 24x7 Security Operations Center (SOC) and Cyber Security Incident Response Team (CSIRT), ensuring security events and incidents are rapidly identified, investigated, contained, remediated, and communicated. This Director is accountable for operational excellence across a follow-the-sun SOC model, effective execution of the cyber incident response lifecycle, development of highly capable cybersecurity professionals, and continuous improvement of security operations processes and capabilities.

How you will make an impact: 

•    Interfaces with key Information Technology (IT) solution teams and vendors. Lead and coordinate cybersecurity incident response activities with Legal, Privacy, Compliance, Human Resources, Corporate Security, technology teams, and other business stakeholders as required. •    Support engagement with external parties, including law enforcement, regulatory authorities, cyber insurance providers, external counsel, and other third parties during significant cybersecurity investigations and incidents. •    Provide timely and accurate briefings to the CISO and senior leadership regarding high-profile cybersecurity incidents, including incident scope, business impact, response status, key decisions, risks, and recommended actions. •    Oversee enterprise security monitoring and investigation capabilities, including SIEM-based monitoring, security alert triage, cloud security monitoring, identity-related investigations, malware analysis, digital forensics, threat intelligence consumption, and other security operations functions within the team’s scope. •    Provide operational input into the design and adoption of AI-enabled cybersecurity workflows, ensuring solutions enhance analyst effectiveness while maintaining appropriate governance, human oversight, accuracy, and risk controls. •    Manage operational readiness for major cybersecurity events, including surge staffing, escalation paths, communications, technical coordination, and transition between normal security operations and formal incident response activities. •    Support regulatory, audit, and compliance activities by providing evidence of security monitoring and incident response controls and ensuring alignment with applicable frameworks and requirements, including HIPAA, HITRUST, PCI DSS, NIST Cybersecurity Framework, SOX, SEC cybersecurity requirements, and applicable breach notification obligations. •    Develop business-level presentations, operational reporting, incident briefings, and strategic recommendations that enable senior leadership to understand cybersecurity risk, operational performance, capability gaps, and investment priorities. •    Hires, trains, coaches, counsels, and evaluate performance of direct reports.

Minimum Requirements:

Requires an BA/BS degree in Information Technology, Computer Science or related field of study and a minimum of 7 years of IT management experience; or any combination of education and experience, which would provide an equivalent background.

Preferred Skills, Capabilities and Experiences: 

•    Demonstrated experience leading enterprise Security Operations Center, Cyber Security Incident Response, or comparable cybersecurity operations functions is preferred. •    Extensive experience managing cybersecurity incidents across the incident response lifecycle, including identification, triage, investigation, containment, eradication, recovery, evidence preservation, and post-incident review is preferred. •    Cybersecurity certifications such as CISSP, CISM, GCIH, GCFA, GCIA, or comparable industry certifications are strongly preferred. •    Demonstrated record of building high-performing security operations teams and improving operational maturity, investigation quality, analyst effectiveness, and incident response outcomes is preferred. •    Prior experience leading a 24x7 enterprise Security Operations Center and Cyber Security Incident Response Team is strongly preferred. •    Strong working knowledge of healthcare and cybersecurity regulatory and compliance requirements, including HIPAA, HITRUST, PCI DSS, NIST Cybersecurity Framework, SOX, SEC cybersecurity requirements, and state or federal breach notification requirements is strongly preferred.  

Job Level:

Director

Workshift:

Job Family:

IFT > IT Tech Strategy Please be advised that Elevance Health only accepts resumes for compensation from agencies that have a signed agreement with Elevance Health. Any unsolicited resumes, including those submitted to hiring managers, are deemed to be the property of Elevance Health.

Who We Are

Elevance Health is a health company dedicated to improving lives and communities – and making healthcare simpler. We are a Fortune 25 company with a longstanding history in the healthcare industry, looking for leaders at all levels of the organization who are passionate about making an impact on our members and the communities we serve.

How We Work

At Elevance Health, we are creating a culture that is designed to advance our strategy but will also lead to personal and professional growth for our associates. Our values and behaviors are the root of our culture. They are how we achieve our strategy, power our business outcomes and drive our shared success - for our consumers, our associates, our communities and our business.

We offer a range of market-competitive total rewards that include merit increases, paid holidays, Paid Time Off, and incentive bonus programs (unless covered by a collective bargaining agreement), medical, dental, vision, short and long term disability benefits, 401(k) +match, stock purchase plan, life insurance, wellness programs and financial education resources, to name a few.

Elevance Health operates in a Hybrid Workforce Strategy. Unless specified as primarily virtual by the hiring manager, associates are required to work at an Elevance Health location at least once per week, and potentially several times per week. Specific requirements and expectations for time onsite will be discussed as part of the hiring process.

The health of our associates and communities is a top priority for Elevance Health. We require all new candidates in certain patient/member-facing roles to become vaccinated against COVID-19 and Influenza. If you are not vaccinated, your offer will be rescinded unless you provide an acceptable explanation. Elevance Health will also follow all relevant federal, state and local laws.

Elevance Health is an Equal Employment Opportunity employer, and all qualified applicants will receive consideration for employment without regard to age, citizenship status, color, creed, disability, ethnicity, genetic information, gender (including gender identity and gender expression), marital status, national origin, race, religion, sex, sexual orientation, veteran status or any other status or condition protected by applicable federal, state, or local laws. Applicants who require accommodation to participate in the job application process should submit the following form: Accessibility Accommodation Request Form and a member of the team will be in contact. Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state, and local laws, including, but not limited to, the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act.

Prospective employees required to be screened under Florida law should review the education and awareness resources at HB531 | Florida Agency for Health Care Administration.

NOTE: Workday keeps job postings active through 11:59:59 PM on the day before the listed end date. Example: If the end date is 3/13, the posting will automatically come down on 3/12 at 11:59:59 PM. In other words — the job is posted until 3/13, not through 3/13.