Security Operations

• Lead a three-person security team as a player-coach and remain a hands-on technical contributor
• Own, configure, tune, troubleshoot, and rationalize BWE’s security tool stack
• Own detection and response outcomes, including alert quality, escalation, and MDR/vendor accountability
• Set detection, logging, telemetry, and security architecture standards across cloud, SaaS, endpoint, identity, application, infrastructure, and data platforms
• Lead incident response from triage through recovery and post-incident review, including playbooks and on-call participation
• Drive vulnerability management from discovery and prioritization through remediation and verification
• Implement data protection controls for confidential financial information, including classification, encryption, retention, and data loss monitoring
• Maintain secure SDLC practices, code scanning standards, software supply chain security, and application security assessments
• Assess and monitor third-party/vendor security and contractual requirements
• Lead cyber risk assessments, penetration tests, tabletop exercises, control reviews, identity reviews, and social engineering exercises
• Partner with the Chief Digital Officer and Compliance on information security policies, standards, and procedures
• Maintain alignment to NIST CSF and CIS Controls and track control gaps to closure
• Implement, operate, and evidence technical controls for Fannie Mae, Freddie Mac, HUD, FHA, rating agencies, and clients
• Automate detection, response, investigation, and reporting using scripting, APIs, playbooks, and AI
• Partner with Technology Operations to test and improve cyber resilience and recovery
• Own the security awareness program and operational security metrics
• Serve as a security partner to Legal, Compliance, HR, and business teams and support client, rating agency, and GSE security representation
• Set patching standards and govern exceptions with Technology Operations
• Lead security triage, investigation, forensics, and corrective actions while Technology Operations handles service restoration
• Own vulnerability discovery, prioritization, and validated closure while Technology Operations performs remediation

Director of Security Operations