Director, Security Operations

Directs security operations at Gibson Dunn from New York, with firm-wide responsibility for threat hunting, detection and incident response. The role reports to the Chief Information Security Officer and advises the rest of the Information Security team on how current threat actors operate, on emerging threats and on fresh indicators of compromise.

The director builds and keeps improving the firm's hunting, event analysis and response capability, and writes the processes and policies that make sure threats are caught and dealt with quickly. It is a hands-on post: the director carries out complex analysis including malware work, takes charge when incidents happen, is the last point of escalation for detection and response questions, and helps administer the SIEM and other security platforms. Other duties include getting indicators of attack and compromise into the right systems, curating threat intelligence for both people and machines, working with IT managers on security policy for internal systems, leading the choice of new security tools, and passing knowledge on to the team. When the CISO is unavailable, the director briefs senior firm leadership.

The firm wants five to seven years across intelligence, security or IT, three to five of them in incident response, forensics, threat hunting or event analysis, and one to three years managing security staff. CISSP is required, plus two of CISM, CSX-P, GREM, OSCP or GCIH. Strong DFIR, packet analysis and SIEM skills are expected, along with an understanding of security across SaaS, Microsoft, Cisco and Unix/Linux environments.