Position: Global Director, Security Operations Center (SOC)
Reports To: Chief Customer Officer (CCO)
Department: Security Operations
Location: Hybrid – College Park, MD (on-site 2–3 days per week)
Work Authorization: US Citizenship Required

BlueVoyant is seeking a Global Director, Security Operations Center (SOC) to lead our 24/7/365 security operations across the US, Europe and the Philippines. Reporting directly to the Chief Customer Officer, you will own the strategy, performance and customer outcomes of a global SOC. This is a senior, highly visible leadership role with significant cross-functional influence, shaping how customers worldwide experience our managed security services and driving client retention, operational excellence and scalable growth.

What You'll Do:

• Set and execute the global SOC strategy, operating model and roadmap, aligned to company objectives and customer commitments.
• Lead, develop and hold accountable the US and UK/EMEA SOC Managers, building a high-performing leadership bench and a consistent “one SOC” culture across regions and time zones.
• Own end-to-end SOC service delivery for all customers, ensuring world-class quality, SLA attainment and consistent performance across the follow-the-sun model.
• Serve as the executive escalation point for critical incidents and customer escalations, partnering with Client Success and the CCO on remediation plans, executive communication and client retention.
• Define, measure and report global SOC KPIs and metrics (SLA performance, incident trends, quality, efficiency, customer outcomes) to the CCO and executive leadership.
• Drive workforce and capacity planning, budget management, shift and coverage models, and hiring strategy across the US, Europe and the Philippines.
• Partner cross-functionally with Client Success, Content Engineering, Threat Hunt, Threat Intelligence, Product, Sales and Engineering leadership to drive service improvements and represent SOC priorities in company-wide decision-making.
• Champion automation, AI and process standardization to improve analyst efficiency, scalability and detection-to-response outcomes.
• Oversee incident investigation, declaration, handling, response and documentation standards globally, ensuring quality and consistency.
• Lead post-incident reviews for critical events and embed lessons learned into processes, playbooks and training.
• Own global SOC policies, procedures and incident response reporting, ensuring alignment with contractual, regulatory and compliance requirements, including US federal contract requirements.
• Engage directly with customer executives and IT/security leadership, including participation in strategic reviews, QBRs and pre-sales conversations where SOC expertise is required.
• Build career paths, training and development frameworks for Team Leads and Analysts to strengthen retention and succession planning.
• Maintain a strong awareness of the evolving threat landscape and ensure the SOC adapts its capabilities accordingly.

• Significant experience leading Security Operations at scale, including managing managers across multiple regions and time zones.
• Proven track record of leading a global or multi-site SOC (or equivalent MSSP/MDR operation) of 50+ staff in a 24/7/365 environment.
• Demonstrated success owning customer escalations and executive client relationships, with a focus on service quality and retention.
• Experience defining and delivering operational metrics, budgets, capacity plans and executive-level reporting.
• Strong cross-functional leadership and the ability to influence senior stakeholders across Customer Success, Product, Engineering and Sales.
• Deep technical understanding of SOC operations, incident response, intrusion detection/prevention and threat analysis.
• Advanced knowledge of network protocols and devices, and of Windows, macOS and Unix/Linux environments.
• Hands-on familiarity with SIEM, SOAR and XDR platforms (Microsoft Sentinel, Defender and Splunk preferred).
• Experience driving automation and process improvement within security operations.
• Exceptional written and verbal communication skills, with the ability to present complex technical topics clearly to executive and non-technical audiences.
• Composure and sound judgment in high-pressure situations.
• Strong knowledge of SIEM, SOAR and EDR/XDR; incident response frameworks and post-incident review; malware detection and packet analysis; network monitoring and HIDS/NIDS; case management and knowledge base systems; email security, web security gateways and DLP; encryption, network access control and vulnerability management.
• Ability and willingness to work on-site in College Park, MD 2–3 days per week, with occasional international travel.

• Experience leading or partnering with teams based in the Philippines and Europe.
• Experience in an MSSP, MDR or managed security services environment.
• Background in intrusion analysis, digital forensics, threat hunting or penetration testing.
• 12+ years of experience in security operations, including 5+ years leading SOC managers or multi-team operations.
• Familiarity with frameworks such as MITRE ATT&CK, NIST CSF and NIST 800-61.
• Relevant certifications such as CISSP, CISM, GCIH, GCIA, GCFA or GSOM.

• Bachelor's degree in Information Security, Computer Science or a related technical field, or equivalent professional experience in security/network operations.
• A Master's degree in Cybersecurity, Information Assurance or Business Administration is preferred.

• Shape and lead a global, 24/7 Security Operations Center, with the scope to define its strategy, operating model and growth as the business scales.
• Hold a high-impact executive role reporting to the Chief Customer Officer, directly influencing customer experience, retention and cross-functional decision-making across the company.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.

About BlueVoyant
BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digital footprints as a single attack surface. The company’s award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance.

Led by CEO, John Hernandez, BlueVoyant’s highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.

All employees must be authorized to work in the United States of America.  BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements, BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.

Disclaimer: Please note that pursuant to contractual requirements and applicable law, for employees to perform work on some of the company’s federal contracts, U.S. citizenship is required. Accordingly, an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status. Furthermore, individuals may be subject to additional background checks and fingerprinting.

#LI-AH1 
#LI-Remote

Important Information for Applicants: BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with added insights to support fair and efficient hiring decisions. All applications are reviewed by a member of our hiring team, and final hiring decisions are made by humans, not AI. By submitting your application, you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process.

Interview Expectations: As part of our interview process, we assess your experience through real-time discussion, so we expect responses to be your own. While we embrace the use of AI within our business and recruitment process, we do not permit its use during interviews. Any suspected use of AI during an interview will be challenged, and this may include the use of detection tools.

BlueVoyant Candidate Privacy Notice: To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice