Envista Security Operations & Engineering Lead (Brea/Irvine, CA)

JOB SUMMARY:

Must reside within a commutable distance to both Brea, CA and Irvine, CA, as the office location will be relocated from Brea to Irvine in approximately Q1 2028. This is not a hybrid or remote opportunity and requires onsite presence 4 days per week.

We are seeking a strategic and hands-on Security Operations and Engineering Lead to serve as Envista’s senior technical expert for security operations, detection engineering, incident response, and security platform capabilities. Operating with a high degree of autonomy, this role translates the Global Head of Information Security & GRC’s direction into scalable capabilities, operating models, roadmaps, and measurable outcomes.

This leader provides domain leadership for the SOC, incident response program, detection lifecycle, and security tooling ecosystem and is responsible for building scalable, threat-informed, and measurable security operations. The role shapes direction within the Security Operations & Engineering domain, recommends priorities and investments, and influences enterprise decisions through technical expertise, while final accountability for Envista’s overall cybersecurity strategy remains with the Global Head of Information Security & GRC.

PRIMARY DUTIES AND RESPONSIBILITIES:

Security Operations Leadership

• Lead enterprise security operations including monitoring, triage, investigation, escalation, and response.
• Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes.
• Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and the cybersecurity strategy established by the Global Head of Information Security & GRC.
• Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness.
• Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap for approval by the Global Head of Information Security & GRC.

Security Engineering & Platform Management

• Develop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms.
• Drive automation across triage, enrichment, containment, and reporting workflows.
• Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities across the enterprise.
• Define enterprise logging and telemetry strategy including onboarding, parsing, normalization, retention, and coverage standards.
• Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement based on enterprise risk, business value, and alignment with cybersecurity priorities.

Incident Response & Threat Management

• Provide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications, within the governance and escalation framework established by the Global Head of Information Security & GRC.
• Serve as the senior operational and technical lead for major incidents, directing containment, eradication, recovery, and root cause analysis and advising executive leadership on response options and business implications.
• Ensure post-incident reviews drive durable control improvements
• Develop response strategies for novel or unprecedented cybersecurity events where established playbooks are insufficient.
• Coordinate with Legal, Privacy, HR, IT, and Communications

Detection Engineering & Monitoring

• Build detection engineering lifecycle: hypothesis → development → testing → tuning → deployment → validation → retirement.
• Develop behavior-based and threat-informed detections aligned to MITRE ATT&CK.
• Expand monitoring across endpoint, identity, cloud, SaaS, network, and critical applications.
• Anticipate emerging detection gaps and develop innovative, threat-informed solutions using red team, penetration testing, vulnerability, incident, and external threat intelligence.

Exposure & Control Operations

• Shape and advance exposure management, asset inventory visibility, and attack surface monitoring capabilities across the enterprise.
• Drive continuous control monitoring and validation of key security controls.
• Improve vulnerability remediation workflows and risk reduction outcomes.
• Drive measurable improvements in enterprise cyber resilience, operational continuity, and material-risk reduction across business units and technology environments.

Leadership & Stakeholder Management

• Build and lead high-performing security operations and engineering teams and strategic partners, while serving as the senior technical leader for the domain.
• Design and implement the Security Operations & Engineering operating model, defining roles, decision rights, governance, and accountability across internal teams and service partners.
• Advise executive leadership on threats, incidents, control gaps, maturity, strategic tradeoffs, and recommended investments, translating complex technical issues into clear business implications.
• Influence GRC, Audit, IT, Architecture, and business leaders to align on enterprise standards, resolve complex cross-functional risks, and advance cybersecurity priorities without relying solely on direct authority.