Security Operations & Engineering Lead

Envista Holdings Corporation

. Lead enterprise security operations including monitoring, triage, investigation, escalation, and response .

Posted 10/13/2026full-timeBrea • California • United StatesSenior💰 $182,900 - $223,600 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in leading enterprise security operations, including incident response, detection engineering, and security strategy development. Proficient in managing complex security environments and driving measurable improvements in cyber resilience and operational continuity.

Highest-signal resume keywords

10+ Years Cybersecurity ExperienceSecurity Operations LeadershipSIEM Platform ExpertiseCloud Security ExperienceIncident Response Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection EngineeringIncident ResponseSecurity OperationsCybersecurity Strategy DevelopmentVulnerability RemediationAutomation in Security WorkflowsThreat Intelligence AnalysisExposure ManagementControl MonitoringRisk Reduction

Soft Skills

Executive AdvisementInfluencing Enterprise DecisionsProblem SolvingTeam LeadershipCollaboration

Tools & Technologies

SIEM PlatformsMicrosoft SentinelSplunkQRadarChronicleCloud Security PlatformsSOAREDR/XDRCSPMDLP

Certifications & Qualifications

CISSPCISMCCSPGIAC CertificationsMicrosoft Security CertificationAWS Security CertificationAzure Security CertificationGCP Security Certification

Industry Keywords

SOCMSSPMDRZero Trust SecurityCyber ResilienceOperational ContinuityRegulatory ComplianceEnterprise RiskGovernanceIncident Management

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformSplunk

About the role

Key responsibilities & impact

Lead enterprise security operations including monitoring, triage, investigation, escalation, and response
Define and govern the operating model across the internal SOC and MSSP/MDR partners, including service strategy, SLAs, alert quality, escalation paths, accountability, and performance outcomes
Design and mature a scalable 24x7 monitoring model aligned to enterprise risk, business priorities, and cybersecurity strategy
Define KPIs/KRIs including MTTD, MTTR, alert fidelity, detection coverage, and response effectiveness
Develop and recommend the Security Operations & Engineering domain strategy, priorities, and investment roadmap
Develop and drive the multiyear capability roadmap and target-state architecture for SIEM, SOAR, EDR/XDR, CSPM, DLP, identity security, and cloud security platforms
Drive automation across triage, enrichment, containment, and reporting workflows
Establish technical principles, standards, and decision frameworks for security operations and engineering capabilities
Define enterprise logging and telemetry strategy, including onboarding, parsing, normalization, retention, and coverage standards
Evaluate capability gaps and recommend platform investments, consolidation, modernization, or retirement
Provide domain leadership for the enterprise incident response program, including playbooks, exercises, breach workflows, and communications
Serve as senior operational and technical lead for major incidents, directing containment, eradication, recovery, root cause analysis, and executive advisement
Ensure post-incident reviews drive durable control improvements
Develop response strategies for novel or unprecedented cybersecurity events
Coordinate with Legal, Privacy, HR, IT, and Communications
Build detection engineering lifecycle and develop behavior-based, threat-informed detections aligned to MITRE ATT&CK
Expand monitoring across endpoint, identity, cloud, SaaS, network, and critical applications
Anticipate detection gaps and develop threat-informed solutions using red team, penetration testing, vulnerability, incident, and external threat intelligence
Advance exposure management, asset inventory visibility, and attack surface monitoring
Drive continuous control monitoring and validation of key security controls
Improve vulnerability remediation workflows and risk reduction outcomes
Drive measurable improvements in cyber resilience, operational continuity, and material-risk reduction
Build and lead high-performing security operations and engineering teams and strategic partners
Design and implement the operating model, defining roles, decision rights, governance, and accountability
Advise executive leadership on threats, incidents, control gaps, maturity, strategic tradeoffs, and investments
Influence GRC, Audit, IT, Architecture, and business leaders to align on enterprise standards and advance cybersecurity priorities

Requirements

What you’ll need

Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Business, Engineering, or a related field
Equivalent industry experience, military service, professional certifications, and demonstrated leadership experience are valued equally
10+ years of progressive cybersecurity experience, including substantial depth in security operations, detection engineering, incident response, or security engineering
7+ years leading complex security operations, engineering, SOC, or incident response capabilities, teams, or enterprise programs
Experience operating security capabilities across cloud, SaaS, endpoint, identity, and enterprise environments
Experience managing MSSP, MDR, SOC-as-a-Service, or strategic security service providers
Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Chronicle, etc.)
Experience in Azure, AWS, or GCP environments
Experience developing enterprise security strategy, capability roadmaps, architecture, standards, and operating models within an assigned domain
Ability to solve novel, ambiguous, and highly complex security problems with broad enterprise impact
Understanding of Zero Trust security principles and modern detection strategies
Ability to advise executive leadership, influence enterprise decisions, and translate complex technical risks into business implications, strategic options, and investment recommendations
Experience leading highly complex investigations and incident response across security, IT, Legal, Privacy, HR, Communications, and executive stakeholders in situations with significant operational, regulatory, financial, or reputational implications
Preferred: experience defining and executing multiyear security capability roadmaps, target-state architectures, and operating models
Preferred: experience building or transforming an enterprise SOC and security engineering capability in a global or multi-business environment
Preferred: experience supporting a global or multi-business-unit environment
Preferred: experience leading incident response for major cybersecurity events
Preferred certifications: CISSP, CISM, CCSP, GIAC certifications (GCIH, GCIA, GCFA, GMON), Microsoft Security, Splunk, Microsoft Sentinel, CrowdStrike, or AWS/Azure/GCP security certifications

Benefits

Comp & perks

Annual performance bonus
Medical benefits
Dental benefits
Vision benefits
401K match
Other applicable compensation plans