This role pays more than
65%
of similar roles. Most pay
$165,650–$235,500
— the shaded band above.
At the midpoint, this role pays about
$216k
versus about
$201k
for comparable roles.
Based on 240 similar postings.
Employer
About CVS Health
CVS Health is a leading American healthcare company operating retail pharmacies, pharmacy benefit management services, and a health insurance segment through Aetna, one of the nation''s largest health insurers. Industry: Healthcare & Pharmacy
CVS Health currently has
86 open roles
on FindRole.
Listed pay typically runs
$118,450–$284,280
across 85 roles with salary data.
The Lead Director - Security Operations Center (SOC) leads the cybersecurity operations function for a rapidly evolving healthcare business. This role is responsible for building and maturing security operations capabilities, including threat monitoring, detection, investigation, response, and threat hunting activities to protect critical business operations and sensitive data in a highly regulated environment. The leader manages a high-performing team while establishing operational processes, service levels, and metrics. Key responsibilities include coordinating incident responses, improving detection engineering, and implementing security automation and AI-enabled capabilities. The role requires expertise in SIEM, EDR/XDR, SOAR, Microsoft Sentinel, CrowdStrike Falcon, Wirespeed, and Microsoft Security technologies like Defender XDR and Entra ID. Candidates must navigate cloud, identity, and network environments across Azure, GCP, and AWS while ensuring cyber resilience against emerging threats such as ransomware.
Lead the strategy, execution, and continuous improvement of all Security Operations Center functions including threat monitoring and hunting.
Serve as the primary escalation point for significant cyber incidents and coordinate response efforts across technical and business stakeholders.
Drive improvements in detection engineering, investigation processes, and automated workflows to reduce risk and improve response times.
Develop security standards and controls aligned with regulatory requirements and industry best practices for cyber resilience.
Manage security operations across cloud, endpoint, identity, and network environments while optimizing the use of security technologies.
Build and mentor a high-performing team of security professionals through coaching and career development opportunities.
Establish metrics and reporting to demonstrate operational performance, risk reduction, and effectiveness to senior leadership.
What we're looking for
10+ years of progressive cybersecurity experience within medium-large scale environments.
5+ years leading Security Operations Center (SOC), Incident Response, Cyber Defense, or Threat Detection teams.
5+ years of experience operating and optimizing enterprise security platforms including SIEM, EDR/XDR, SOAR, and automation technologies.
3+ years of experience building, managing, and maturing security operations capabilities like threat hunting and digital forensics.
Experience supporting cloud-native and hybrid security operations across Microsoft Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS) (preferred).
Hands-on experience with Microsoft Security technologies or Google Security Command Center (preferred).
Artificial Intelligence
Automation
Video Analytics
Access Control Systems
ISO 27001
SOC 2
SLA
Incident Management
Mass Notification Platforms
Data Logging
Workflow Automation
Microsoft Sentinel
Microsoft Defender for Cloud
Defender for Endpoint
Defender for Office
Defender for Identity
Entra ID
Purview Data Security
SIEM
XDR
Cloud Security
Data Loss Prevention (DLP)
Information Rights Management (IRM)
Azure
Cybersecurity
Security Architecture