Cyber Defense, Adversary Emulation Director

Join Mizuho as a Cyber Defense, Adversary Emulation Director!

The Cyber Defense organization within Mizuho Americas Services (MAS) operates under the CISO and is responsible for identifying, analyzing, and mitigating cyber threats across the Mizuho enterprise. The Adversary Emulation function play a critical role in proactively improving the firm’s security posture by leveraging vulnerability intelligence of real‑world threats, identifying systemic weaknesses, and driving remediation across infrastructure, applications, and cloud environments.

The Adversary Emulation Director leads Mizuho's proactive security functions, with primary responsibility for vulnerability management, threat intelligence, threat hunting, and red team operations across the enterprise. This role focuses on identifying, prioritizing, and driving remediation of real-world threats and across the enterprise, thinking like an attacker to emulating adversary tactics to continuously test and strengthen the firm's defenses.

The role combines deep hands-on offensive and threat expertise with strategic leadership, partnering with security engineering, incident response, and technology teams to translate threat insight into measurable risk reduction. Automation, AI-enabled tooling, and workflow orchestration are applied to scale these capabilities and improve analyst efficiency, but they supplement — rather than define — the core mission of vulnerability management, threat intelligence, threat hunting, and adversary emulation.

Key Responsibilities

• Lead and mature the enterprise vulnerability management program, including discovery, risk-based prioritization, remediation tracking, and reporting across infrastructure, applications, and cloud environments.
• Direct threat intelligence operations, collecting and analyzing intelligence on threat actors, tactics, techniques, and procedures (TTPs), and emerging vulnerabilities to inform defensive priorities and proactive hunting.
• Plan and lead threat hunting campaigns that proactively identify malicious activity, misconfigurations, and systemic weaknesses across endpoint, network, and cloud environments.
• Design and lead red team and adversary emulation exercises that replicate real-world attacker tactics to test detection, response, and control effectiveness across the enterprise.
• Translate findings from vulnerability management, threat intelligence, hunting, and red team activity into clear, prioritized, and actionable remediation guidance for engineering and business stakeholders.
• Partner with Security Operations, incident response, and infrastructure teams to drive closure of identified weaknesses and continuously improve the firm's security posture.
• Establish metrics, reporting, and governance that measure risk reduction, remediation timeliness, and the effectiveness of the firm's offensive and proactive security programs.
• Develop and mentor a team of analysts and engineers across vulnerability management, threat intelligence, threat hunting, and red team functions, fostering a collaborative, learning-driven culture.
• Leverage automation, AI-enabled tooling, and workflow orchestration to scale vulnerability triage, threat analysis, and hunting, reducing manual effort while maintaining accuracy, auditability, and control.
• Contribute to standards, playbooks, documentation, and controls that promote consistency, repeatability, and shared ownership across the firm's proactive and offensive security functions.

Qualifications

• 10+ years of experience in information security, with deep expertise across vulnerability management, threat intelligence, threat hunting, red team, or offensive security, preferably within financial services or another regulated enterprise environment.
• Proven experience leading or executing red team and adversary emulation engagements, including planning, execution, and translating findings into actionable remediation.
• Hands-on experience running vulnerability management programs and platforms, including discovery, risk-based prioritization, and remediation tracking across infrastructure, applications, and cloud, preferably for a global organization.
• Strong threat intelligence experience — collecting, analyzing, and operationalizing threat actor TTPs and emerging vulnerabilities, mapped to frameworks such as MITRE ATT&CK.
• Demonstrated threat hunting experience across endpoint, network, and cloud telemetry to proactively detect malicious activity and systemic weaknesses.
• Strong hands-on scripting skills (Python, PowerShell, or similar) to support testing, analysis, and automation of offensive and proactive security workflows.
• Strong understanding of offensive security tooling and techniques, such as command-and-control (C2) frameworks, exploitation, penet