Defense Information Security Commander

Job description

The role of Defense Information Security Commander at the employer involves providing technical leadership in defensive security, managing a team of security engineers and analysts, and driving security initiatives across the organization. Key responsibilities: lead security architecture and design reviews for IT, cloud, and product initiatives; drive cloud security on GCP and AWS, including IAM and security posture; lead Secure SDLC/DevSecOps program with application security and tooling in CI/CD; own vulnerability management, remediation, penetration testing, and red team engagements; oversee endpoint, infrastructure, and network security, including EDR, DLP, and firewalls; lead detection engineering, threat intelligence, and incident response with complex investigations; manage and develop security engineers and analysts, providing mentorship and performance management; partner with Engineering, IT, Compliance, and other teams to improve the employer's overall security posture and standards.

Requirements

• 5+ years experience in cybersecurity or information security with technical leadership or senior-level responsibilities
• experience leading security programs covering security architecture, cloud security, vulnerability management, and application security
• strong understanding of defensive and offensive security including penetration testing, red/purple teaming, threat hunting, and incident response
• hands‑on experience with SIEM, EDR/XDR, vulnerability management, CSPM, DLP and security monitoring platforms
• strong knowledge of GCP and/or AWS, IAM, cloud and infrastructure security
• experience with DevSecOps, Secure SDLC, SAST, DAST, SCA and container security
• scripting and automation skills to develop or oversee security tooling and integrations
• knowledge of SAMA CSF, NCA ECC, PCI‑DSS and ISO 27001
• experience in regulated FinTech or banking environment
• strong technical leadership, stakeholder management and team development skills
• CISSP or CISM and OSCP or equivalent certifications required.

Skills