Associate Director, Cybersecurity Incident Response

The Associate Director, Product Management - Cybersecurity Operations & Incident Response is responsible for leading efforts in detecting, investigating, and responding to security threats and incidents. This role involves developing and overseeing the execution of proactive threat hunting programs to identify and mitigate both external and internal threats. The Associate Director will also develop and improve playbooks and runbooks for responding to threats and optimize the use of security tools such as SIEM, XDR, SOAR, and case management platforms. Additionally, this role requires close collaboration with other product teams, including IT leadership, to strengthen Exelixis' cybersecurity posture. Extensive knowledge and experience in threat investigation, both internal and external, are essential, as the role may sometimes require performing threat investigations.

ESSENTIAL DUTIES AND RESPONSIBILITIES:

• Lead efforts in detecting, investigating, and responding to security threats and incidents.
• Lead the team's growth by optimizing incident response processes, reducing false positives, and enhancing threat detection and response capabilities.
• Develop and oversee the execution of proactive threat hunting programs to identify and mitigate both external and internal threats.
• Ensure that the team responds appropriately to threats and continuously improve detection and response capabilities – which may include collaborating with security vendors to conduct purple team exercises.
• Develop and improve playbooks and runbooks for responding to threats.
• Optimize the use of security tools such as SIEM, XDR, SOAR, and case management platforms.
• Work closely with other product teams, including IT leadership, to strengthen Exelixis' cybersecurity posture and provide guidance and direction to other IT professionals regarding security best practices and ensure compliance with industry standards and regulations when necessary.
• Develop and promote a strong cybersecurity culture within the organization, ensuring that all employees are aware of and adhere to security policies and best practices.
• Stay current with the latest threat landscape and emerging trends in cybersecurity to proactively identify and mitigate potential security risks.
• Contribute to the overall information security strategy.
• Recruit, motivate, mentor, and lead talent to be their best.

SUPERVISORY RESPONSIBILITIES:

• Provide directions to other individuals.
• Manage third-party service providers and consultants.
• Supervises staff, including hiring, scheduling and assigning work, reviewing performance, and

recommends salary increases, promotions, transfers, demotions, or terminations.

EDUCATION/EXPERIENCE/KNOWLEDGE & SKILLS:

Education:

• Bachelor’s degree in related discipline and eleven years of related experience; or
• Master’s degree in related discipline and nine years of related experience; or
• PhD degree in related discipline and five years of related experience; or
• Equivalent combination of education and experience
• CSSP, CCSP, CISSP, CISM or similar certification required

Experience:

• Demonstrated leadership in cybersecurity operations, with a deep technical knowledge of threat hunting, investigation, and incident response best practices. Ideally, this includes extensive hands-on experience as a SOC or incident response practitioner.
• Strong experience in conducting thorough investigations of security incidents, including but not limited to, malware infections, phishing attacks, insider threat and data breaches.
• Experience developing and implementing Cybersecurity Operations metrics and Key Performance Indicators to provide visibility into operational effectiveness and efficiency.  
• Proven experience in conducting phishing simulations to test the organization's resilience against phishing attacks. This includes designing and executing realistic phishing scenarios, analyzing the results, and assessing the effectiveness of current security measures. Additionally, the role involves identifying areas for improvement and implementing strategies to enhance the organization's defenses against phishing threats. This may include employee training programs, updating security policies, and deploying advanced anti-phishing technologies.
• Demonstrated experience and success in leadership roles in information technology and security operations
• Proven experience in successfully executing programs that meet the objectives of excellence in a dynamic business environment
• Experience or working knowledge of cloud, network, and application security