Director, Threat Operations & Penetration Testing

Department Overview

Duties

Strategy & Program Leadership 

• Define and execute the global strategy and multi-year roadmap for Threat Operations and Offensive Security programs 
• Establish measurable goals, KPIs, and OKRs aligned to enterprise cyber risk reduction 
• Drive integration between CTEM, threat hunting, insider risk, detection engineering, and offensive testing to create a unified threat-informed defense model 
• Provide executive-level reporting on program outcomes, risk posture, and operational metrics to GCS and Global Technology leadership 

Threat Operations 

• Insider Risk — Lead the insider threat program to detect, investigate, and mitigate internal threats through behavioral analytics, policy enforcement, and cross-functional partnerships (HR, Legal, Compliance) 
• Threat Hunting — Mature proactive threat hunting capabilities to identify advanced persistent threats, anomalous activity, and gaps in detection coverage across the global enterprise 
• Cyber Threat Exposure Management (CTEM) — Own the CTEM lifecycle including attack surface visibility, exposure prioritization, vulnerability validation, and remediation tracking in partnership with GRC/TPRM and engineering teams 
• Develop playbooks, automation, and operational processes to scale threat operations capabilities 

Offensive Security 

• Lead penetration testing programs across application, cloud, network, infrastructure, mobile, and SaaS environments 
• Plan and execute Red Team and Purple Team operations, breach & attack simulations (BAS), and adversary emulation exercises informed by real-world threat intelligence 
• Oversee the Vulnerability Disclosure Program (VDP) and External Attack Surface Management (EASM) validation activities 
• Translate offensive findings into prioritized, risk-ranked remediation actions and validate effectiveness of security controls and detection capabilities 
• Lead targeted risk assessments and custom exercises (e.g., tabletop simulations, physical security testing, social engineering campaigns) 

Leadership & Team Development 

• Lead, mentor, and scale a high-performing global team of managers, senior analysts, and technical leads across the US and UK 
• Foster a culture of innovation, accountability, continuous improvement, and technical excellence 
• Manage capacity planning, headcount budgeting, and resource allocation across multiple towers and regions 
• Drive continuous improvement through automation, process maturity, and threat-informed testing 

Qualifications

• 10+ years of progressive cybersecurity experience across offensive and defensive domains 
• 5+ years of direct leadership experience managing cybersecurity teams, including people managers 
• Deep expertise in penetration testing, red teaming, threat hunting, insider risk, and/or CTEM 
• Expert-level understanding of adversarial tactics, techniques, and procedures (TTPs), the cyber kill chain, and MITRE ATT&CK framework 
• Extensive experience leading teams that emulate threat activities and understanding the stages of a cyber-attack (reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks) 
• Experience leading global, geographically distributed teams and managing large-scale security programs in complex multinational environments 
• Strong executive communication and stakeholder management skills with the ability to translate technical risk into business impact for senior leadership and CIO-level audiences
• Proven ability to operate with minimal oversight, make quick and effective decisions, and navigate ambiguity in fast-paced, deadline-driven environments 

Desired Skills 

• Professional certifications such as OSCP, GXPN, GCDA, GCPN, GCTI, GCIH, CEH, CISM, or equivalent 
• Expert understanding of cloud security architectures (Azure, AWS, GCP) and modern application security 
• Experience with SIEM/SOAR platforms, detection engineering, and security operations workflows 
• Hands-on experience with offensive security tooling and frameworks (e.g., Cobalt Strike, Burp Suite, BloodHound, Metasploit, custom tooling) 
• Experience managing vulnerability disclosure programs, bug bounty programs, or coordinated disclosure processes 
• Familiarity with insider threat platforms, behavioral analytics, and UEBA solutions 
• Strong understanding of exposure management platforms, EASM, and attack surface monitoring tools 
• Outstanding technical writing skills and the capability to communicate findings and program outcomes to a wide range of technical and non-technical audiences 
• Experience with budgeting, headcount governance, and cross-regional workforce planning 

Compensation

Bonus Eligible: YES

Long - Term Incentive: YES

Benefits Eligible: YES

Salary Range

The expected salary range for this role is $195,371.00 - $244,214.00 per year
 
The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we may also consider your experience, and other job-related factors.