Sandisk understands how people and businesses consume data and we relentlessly innovate to deliver solutions that enable today’s needs and tomorrow’s next big ideas. With a rich history of groundbreaking innovations in Flash and advanced memory technologies, our solutions have become the beating heart of the digital world we’re living in and that we have the power to shape.

Sandisk meets people and businesses at the intersection of their aspirations and the moment, enabling them to keep moving and pushing possibility forward. We do this through the balance of our powerhouse manufacturing capabilities and our industry-leading portfolio of products that are recognized globally for innovation, performance and quality.

Sandisk has two facilities recognized by the World Economic Forum as part of the Global Lighthouse Network for advanced 4IR innovations. These facilities were also recognized as Sustainability Lighthouses for breakthroughs in efficient operations. With our global reach, we ensure the global supply chain has access to the Flash memory it needs to keep our world moving forward.

Description

The Senior Director of Cyber Defense & Operations is a senior cybersecurity leader responsible for protecting the organization against evolving cyber threats through the development, operation, and continuous improvement of enterprise cyber defense capabilities. Reporting directly to the Vice President & Chief Information Security Officer (CISO), this role provides strategic, technical, and operational leadership across Security Operations, Threat Detection and Response, Incident Response, Threat Intelligence, Vulnerability and Exposure Management, Security Monitoring, Security Automation, and Cyber Defense Engineering. The Senior Director is responsible for ensuring the organization can effectively identify, detect, investigate, contain, remediate, and recover from cybersecurity threats and incidents across a complex global technology environment. The role requires deep technical cybersecurity expertise combined with strong leadership, operational management, and executive communication skills. This individual must be comfortable operating at both the technical and executive levels engaging directly with security engineers and analysts during complex security events while also communicating cybersecurity threats, operational risk, and response strategies to the CISO and senior leadership. The successful candidate will be a highly collaborative, technically credible leader who thrives in a fast-paced, global technology organization and can build scalable cyber defense capabilities capable of responding to a rapidly evolving threat landscape. Responsibilities: Cyber Defense Strategy & Leadership

Partner with the CISO to develop and execute the organization's enterprise cyber defense and security operations strategy.
Establish a comprehensive cyber defense operating model encompassing prevention, detection, investigation, containment, response, remediation, and recovery.
Develop and maintain a multi-year roadmap for security operations, threat detection, incident response, threat intelligence, vulnerability management, and cyber defense engineering.
Translate emerging threats and business risks into actionable cyber defense priorities, investments, capabilities, and technical controls.
Establish measurable security operations objectives, service levels, performance metrics, and maturity targets.
Continuously assess cyber defense capabilities against the changing threat landscape and identify opportunities to improve organizational resilience.
Balance security requirements with business velocity, operational requirements, and the needs of a fast-moving global technology organization. Security Operations & Threat Detection
Provide executive leadership and oversight for the organization's Security Operations Center (SOC) and enterprise security monitoring capabilities.
Ensure effective 24x7 monitoring, detection, investigation, escalation, and response capabilities appropriate to organizational risk.
Develop and continuously improve threat detection strategies across endpoints, networks, cloud environments, applications, identity platforms, and enterprise infrastructure.
Establish detection engineering practices that translate threat intelligence, attack techniques, and security events into actionable detection logic and response processes.
Improve visibility across the technology environment by ensuring appropriate logging, telemetry, correlation, alerting, and monitoring capabilities.
Establish processes to continuously evaluate detection effectiveness, identify monitoring gaps, reduce false positives, and improve analyst effectiveness.
Drive implementation of risk-based and intelligence-driven approaches to security operations.
Define and monitor SOC performance metrics including detection coverage, alert quality, response times, investigation effectiveness, and incident trends. Incident Response & Crisis Management
Provide leadership and executive oversight for cybersecurity incident response and major security events.
Maintain and continuously improve the enterprise Cybersecurity Incident Response Plan, playbooks, escalation procedures, and communication protocols.
Ensure the organization maintains the ability to rapidly investigate, contain, eradicate, and recover from cybersecurity incidents.
Serve as a senior escalation point during significant cybersecurity incidents and coordinate technical response activities across Security, IT, Infrastructure, Cloud, Engineering, Legal, Privacy, Communications, and business leadership.
Establish incident severity classifications, escalation thresholds, communication requirements, and executive notification procedures.
Lead or oversee post-incident reviews and root-cause analyses and ensure lessons learned are converted into measurable improvements.
Develop and conduct cybersecurity tabletop exercises, simulations, and response drills involving technical teams and executive leadership.
Coordinate with Legal, Privacy, Compliance, Human Resources, Communications, and other stakeholders when incidents have regulatory, privacy, employee, customer, or reputational implications. Threat Intelligence & Threat Hunting
Develop and mature enterprise cyber threat intelligence capabilities focused on threats relevant to the organization's technology, operations, intellectual property, customers, and supply chain.
Integrate threat intelligence into security monitoring, detection engineering, vulnerability prioritization, incident response, and executive risk reporting.
Establish proactive threat-hunting capabilities designed to identify malicious activity that may bypass traditional security controls.
Monitor evolving attacker techniques, tactics, and procedures using frameworks such as MITRE ATT&CK.
Ensure threat intelligence is translated into actionable defensive measures rather than functioning solely as an informational capability.
Develop processes to identify emerging threats and communicate potential business impact to technical and executive stakeholders. Vulnerability & Exposure Management
Provide leadership and governance for enterprise vulnerability and security exposure management.
Establish risk-based vulnerability prioritization incorporating technical severity, exploitability, asset criticality, threat intelligence, exposure, and business impact.
Partner with Infrastructure, Cloud, Application, Engineering, and IT teams to drive timely remediation of critical vulnerabilities and security exposures.
Establish remediation standards, service-level expectations, exception processes, and escalation procedures.
Provide visibility to the CISO and senior leadership regarding critical vulnerabilities, systemic exposure, remediation performance, and residual risk.
Drive the evolution from traditional vulnerability management toward a broader continuous threat exposure management approach.
Incorporate external attack surface, cloud exposure, identity risk, configuration weaknesses, and other attack paths into enterprise exposure management. Cyber Defense Engineering & Security Tooling
Provide leadership for the architecture, deployment, integration, optimization, and lifecycle management of cyber defense technologies.
Ensure effective operation and integration of technologies such as SIEM, EDR/XDR, NDR, SOAR, vulnerability management, threat intelligence platforms, email security, cloud security, identity security, and related detection and response technologies.
Partner with Security Architecture and Engineering teams to identify security capability gaps and develop appropriate technical solutions.
Establish engineering standards for security monitoring, telemetry, detection, automation, and response.
Continuously evaluate the effectiveness of the cybersecurity technology portfolio and identify opportunities to consolidate, modernize, or replace security technologies.
Ensure security tools are properly configured, integrated, monitored, and measured for operational effectiveness. Security Automation & AI
Drive automation across cybersecurity operations to increase speed, scalability, consistency, and analyst effectiveness.
Develop and implement Security Orchestration, Automation and Response (SOAR) capabilities for repetitive security operations and response activities.
Identify opportunities to automate alert enrichment, investigation, containment, vulnerability prioritization, evidence collection, threat intelligence, and response workflows.
Evaluate and responsibly implement AI and machine-learning capabilities that improve threat detection, investigation, analysis, and security operations.
Partner with engineering and automation resources to integrate cybersecurity platforms through APIs and automated workflows.
Establish appropriate governance and human oversight for automated security response actions.
Measure automation effectiveness based on operational efficiency, response time reduction, analyst workload, and risk reduction. Identity, Cloud & Modern Attack Surface Defense
Ensure cyber defense capabilities provide appropriate visibility into identity, cloud, endpoint, network, application, SaaS, and hybrid infrastructure environments.
Partner with IAM teams to detect identity-based attacks, compromised credentials, privilege escalation, anomalous authentication, and misuse of privileged accounts.
Develop monitoring and response capabilities for major cloud platforms including AWS, Microsoft Azure, and Google Cloud Platform.
Ensure effective monitoring of cloud control planes, workloads, identities, APIs, and security configurations.
Partner with security and technology teams to identify and address attack paths spanning identity, endpoint, cloud, network, and application environments.
Continuously adapt cyber defense capabilities to address changes in enterprise architecture and attacker behavior. Operational Resilience & Continuous Improvement
Establish operational standards, procedures, playbooks, escalation models, and performance expectations across Cyber Defense.
Develop KPIs and KRIs measuring cyber defense effectiveness, including Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), detection coverage, vulnerability remediation, incident trends, automation effectiveness, and control performance.
Conduct regular maturity assessments and benchmarking of cyber defense capabilities.
Identify recurring security issues and drive systemic corrective actions rather than relying solely on individual incident remediation.
Partner with business continuity, disaster recovery, infrastructure, and technology teams to strengthen enterprise cyber resilience.
Ensure cyber defense processes can scale effectively as technologies, business operations, and threat conditions change. Leadership & Management
Build, lead, mentor, and develop a large-global high-performing organization of security operations professionals, incident responders, threat hunters, detection engineers, vulnerability specialists, and cyber defense engineers.
Establish clear roles, responsibilities, career paths, performance expectations, and accountability across the Cyber Defense organization.
Recruit, develop, and retain highly skilled cybersecurity professionals in a competitive talent environment.
Maintain a strong technical culture while developing leadership capabilities throughout the organization.
Promote continuous learning and ensure team members remain current on evolving threats, attack methodologies, technologies, and defensive techniques.
Establish an operating culture emphasizing urgency, accountability, technical excellence, collaboration, automation, and continuous improvement.
Effectively manage multiple concurrent priorities, security incidents, transformation initiatives, and operational demands.
Manage cybersecurity vendors, managed security providers, technology partners, and external incident response resources as required. Financial Ownership
Own and manage the annual Information Security and GRC operating and capital budgets, including budget development, forecasting, variance management, and ongoing financial performance.
Partner with the CISO to develop the multi-year cybersecurity investment strategy and financial roadmap, aligning expenditures with enterprise risk, regulatory requirements, and business priorities.
Lead quarterly budget reviews and forecasts, identifying variances, emerging financial requirements, potential savings, and areas requiring CISO or executive-level decisions.
Manage the financial lifecycle of security technologies, software licensing, managed services, consulting engagements, and other third-party security investments.
Develop and maintain visibility into security vendor commitments, contract renewals, licensing costs, and anticipated future expenditures to minimize unplanned spending.
Partner with Procurement, Finance, Legal, and technology leaders to negotiate and optimize security-related contracts, licensing models, statements of work, and vendor renewals.
Evaluate proposed cybersecurity investments using risk reduction, business value, regulatory requirements, operational impact, and total cost of ownership to support investment decisions.
Identify opportunities to consolidate security technologies, eliminate redundant capabilities, optimize licensing, and improve return on cybersecurity investments.
Develop financial and operational metrics that provide the CISO and executive leadership with visibility into cybersecurity spend, investment effectiveness, forecast accuracy, and resource utilization.
Maintain appropriate controls and documentation supporting purchase approvals, financial audits, vendor governance, and compliance requirements. Executive & Cross-Functional Partnership
Serve as a trusted technical and operational advisor to the CISO regarding cyber threats, incidents, vulnerabilities, security operations, and enterprise exposure.
Translate highly technical cybersecurity events and risks into clear business impacts and actionable recommendations for senior leadership.
Provide concise executive reporting regarding significant threats, incidents, vulnerabilities, operational performance, and cyber defense readiness.
Partner closely with Security Architecture, Security Engineering, GRC, IT, Infrastructure, Cloud, Network, IAM, Application Security, Engineering, Legal, Privacy, Internal Audit, and business leadership.
Support the CISO in communicating cyber defense capabilities, significant risks, major incidents, and security posture to executive leadership and Board-level stakeholders.
Establish strong relationships with external cybersecurity partners, incident response firms, threat intelligence providers, and other security organizations as appropriate.

Qualifications

Requirements:

Demonstrated experience leading cybersecurity operations within a large, complex, global, and fast-paced technology organization.
Deep technical understanding of enterprise cybersecurity architecture, operating systems, networks, cloud platforms, identity, endpoints, applications, and security technologies.
Strong experience with SIEM, SOAR, EDR/XDR, NDR, vulnerability management, threat intelligence, cloud security, IAM/PAM, email security, and security monitoring technologies.
Demonstrated experience managing significant cybersecurity incidents and coordinating complex technical investigations.
Strong knowledge of attacker Tactics, Techniques and Procedures (TTPs) and frameworks such as MITRE ATT&CK.
Experience developing and managing threat detection, detection engineering, threat hunting, and incident response capabilities.
Strong understanding of vulnerability management, attack surface management, threat exposure management, and risk-based remediation.
Demonstrated understanding of cloud security and security operations across AWS, Microsoft Azure, and/or Google Cloud Platform.
Experience implementing automation and orchestration within cybersecurity operations.
Working knowledge of scripting, APIs, automation technologies, and security data integration.
Understanding of emerging uses of AI and machine learning within cybersecurity operations, including both defensive opportunities and associated risks.
Strong understanding of cybersecurity frameworks and standards including NIST CSF, NIST 800-53, CIS Controls, and ISO/IEC 27001.
Experience developing operational metrics, KPIs, KRIs, executive dashboards, and cybersecurity performance reporting.
Proven ability to lead cross-functional technical teams during high-pressure cybersecurity incidents.
Strong vendor and managed security service management experience.
Exceptional communication skills with the ability to effectively communicate with security analysts, engineers, technology leaders, business executives, the CISO, and Board-level audiences.
Demonstrated ability to make sound risk-based decisions quickly in complex environments where complete information may not always be available. Education and Experience:
Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, Engineering, or a related technical discipline; advanced degree preferred.
15+ years of progressive cybersecurity or information security experience, with significant experience in cyber defense, security operations, incident response, threat detection, or security engineering.
10+ years of leadership experience managing cybersecurity operations, engineering, incident response, or related technical security teams.

Additional Information

Sandisk is committed to providing equal opportunities to all applicants and employees and will not discriminate based on their race, color, ancestry, religion (including religious dress and grooming standards), sex (including pregnancy, childbirth or related medical conditions, breastfeeding or related medical conditions), gender (including a person’s gender identity, gender expression, and gender-related appearance and behavior, whether or not stereotypically associated with the person’s assigned sex at birth), age, national origin, sexual orientation, medical condition, marital status (including domestic partnership status), physical disability, mental disability, medical condition, genetic information, protected medical and family care leave, Civil Air Patrol status, military and veteran status, or other legally protected characteristics. We also prohibit harassment of any individual on any of the characteristics listed above. Our non-discrimination policy applies to all aspects of employment. We comply with the laws and regulations set forth in the Equal Employment Opportunity is the Law poster.

Sandisk thrives on the power and potential of diversity. As a global company, we believe the most effective way to embrace the diversity of our customers and communities is to mirror it from within. We believe the fusion of various perspectives results in the best outcomes for our employees, our company, our customers, and the world around us. We are committed to an inclusive environment where every individual can thrive through a sense of belonging, respect and contribution.

Sandisk is committed to offering opportunities to applicants with disabilities and ensuring all candidates can successfully navigate our careers website and our hiring process. Please contact us at [email protected] to advise us of your accommodation request. In your email, please include a description of the specific accommodation you are requesting as well as the job title and requisition number of the position for which you are applying.

Sr. Director, Cyber Defense and Security Operations

Recommended Jobs