This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
The Cyber Security Defense Head of Department (HOD) will lead and mature our organization’s end-to-end defensive security capabilities. This senior leadership role oversees the Security Operations Center (SOC), Blue Team, Red Team, Penetration Testing, Incident Response, Threat & Vulnerability Management (TVM), Application Security, and Adversary Simulation functions. The ideal candidate is both a visionary leader and a seasoned technical expert capable of building high-performing teams, implementing modern security practices, and driving continuous improvement across all cyber defense operations functions.
Job Responsibility:
Develop and execute the Cyber Defense strategy aligned with organizational goals, customer requirements and the evolving threat landscapes
Establish frameworks, processes, and KPIs for SOC, Incident Response, TVM, AppSec, Red/Blue Teaming, and Adversary Simulation
Serve as a senior advisor to the CISO and executive leadership on cyber risks, readiness, and emerging threats
Oversee 24x7 SOC operations, ensuring effective monitoring, detection, and response to security events, across levels 1-3
Drive continuous enhancement of detection engineering, threat hunting, and security analytics
Implement best-in-class security tooling, automation, and operational processes
Lead internal Red Team and offensive security capabilities, including penetration testing
Define testing methodologies, operational rules of engagement, and reporting standards
Translate offensive findings into actionable improvements for defensive teams and architecture
Oversee the Incident Response program, ensuring rapid and effective handling of security incidents
Lead tabletop exercises, simulation drills, and readiness assessments
Facilitate and lead high/critical incident responses, when the Incident Response Manager is unavailable
Coordinate with legal, communications, and executive stakeholders during major incidents
Own the enterprise-wide vulnerability management strategy, including prioritization, remediation, and reporting
Drive continuous scanning, assessment, and metrics to reduce risk across infrastructure, applications, and cloud environments
Collaborate with engineering and operations teams to ensure timely and effective remediation
Facilitate and the zero-day vulnerability response process, when the Incident Response Manager is unavailable
Lead the organization’s AppSec program, including secure SDLC practices, code reviews, SAST/DAST tools, and developer enablement
Partner with software engineering to embed security into product and platform design
Develop and run adversary simulation programs that mimic real-world threat actors
Use intelligence-led scenarios to evaluate detection capabilities, response effectiveness, and organizational resilience
Requirements:
15–20 years of progressive experience across the various cyber defense disciplines (SOC, Incident Response, Red/Blue teams, or similar defensive/offensive functions)
Proven experience leading cyber defense teams
Demonstrated ability to hire, mentor, and lead high-performing technical teams
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science or a related discipline
Strong knowledge of threat detection, incident response, adversary tactics (MITRE ATT&CK), vulnerability management, and secure software development
Excellent incident management, communication, and executive reporting skills
Proficient in English for effective communication and coordination
In the absence of IR team members, utilize a flexible work schedule to facilitate the security incident response process for high/critical incidents
Nice to have:
Masters degree in Cybersecurity, Information Technology, Computer Science or a related discipline is preferred
Industry-recognized credentials such as CISSP, CISM, OSCP/OSCE, GIAC (GSEC, GCIA, GCIH, GPEN, GXPN) are highly desirable
Familiarity with, and prior participation with FIRST (Forum of Incident Response and Security Teams) is preferred
Bi-lingual in English and Korean language proficiency is preferred to support global coordination and communication