Vice President - Cyber Security (Operations)

Job description

Job Description: We are seeking a forward-thinking Cyber Security Operations Leader to lead and transform EXL's global Cyber Defense Center capabilities across mission-critical Security Operations, Threat Detection, Incident Response, Threat Intelligence, Digital Forensics, Security Automation, AI Security Monitoring, and Security Operations Assurance. This role is responsible for evolving EXL's Cyber Defense Center (CDC) into an intelligence-driven, automation-first, and AI-augmented security operations capable of protecting a distributed enterprise comprising of cloud-native systems, Domain Platforms, BPaaS environments, AI-powered solutions, and critical business operations enabling our clients in regulated industries including Insurance, Banking & Financial Services, Healthcare, Energy & Utilities, Travel and Transportation. The successful candidate will strengthen modern detection and response capabilities across traditional Technologies, Engineering Systems, COTS, Cloud, SaaS, and AI ecosystems while strengthening cyber resilience, operational robustness, and executive visibility into emerging cyber risks. This leader will partner closely with Enterprise Security, Cloud Security Engineering, and Application Security within the Cyber Security functions and with cross-functions of Cloud Infrastructure, Data & AI teams, Analytics & AI Services and business stakeholders to continuously improve EXL's security posture and operational resilience while enabling secure innovation and digital transformation. - **Responsibilities: Security Posture Monitoring, Incident Response and Crisis Management** - Drive established enterprise Incident Response capability, including a dedicated Computer Incident Response Team (CIRT) with clearly defined roles, escalation procedures, and communication protocols for both internal and client-impacting incidents. - Develop, maintain, and regularly test comprehensive incident response playbooks covering the full spectrum of attack scenarios: ransomware, BEC, supply chain compromise, insider threats, DDoS, APT intrusions, data breaches, cloud credential compromise, AI model tampering, and client data exposure. - Serve as the executive incident commander during major security incidents (P1/P2), coordinating cross-functional response across Technology, Legal, Communications, HR, executive leadership, and Industry Security Business Partners for client-impacting events. - Lead post-incident reviews (PIRs) and blameless retrospectives, ensuring root cause analysis, lessons learned, and remediation actions are tracked to closure and fed back into detection engineering, cloud security, and application security (Pillar 6) improvement cycles. - Build and maintain a digital forensics capability for conducting investigations across endpoints, servers, cloud workloads, email systems, containers, and mobile devices - Establish relationships with external incident response retainers, law enforcement (FBI Cyber, CISA), and industry ISACs (FS-ISAC, H-ISAC, IT-ISAC) for coordinated threat response and intelligence sharing **2. Threat Intelligence & Proactive Threat Hunting** - Build and operationalize a Cyber Threat Intelligence (CTI) program that collects, analyzes, and disseminates actionable intelligence from OSINT, commercial feeds (Google Mandiant, CrowdStrike Intel), dark web monitoring, industry ISACs, and government advisories. Establish a proactive threat hunting program with dedicated hunters who develop hypotheses based on threat intelligence, MITRE ATT&CK TTPs, and environmental anomalies to identify threats that evade automated detection — including cloud-native and AI-specific hunting scenarios. **3. AI Security Operations and AI Threat Defense** - Establish monitoring, detection, and response capabilities for AI-enabled applications, LLM platforms, AI agents, RAG architectures, model repositories, and AI runtime environments. - Develop detection coverage aligned to MITRE ATLAS, OWASP Top 10 for LLM Applications, and emerging AI threat frameworks - Lead operational readiness for AI-related incidents including prompt injection, model abuse, model theft, data leakage, excessive agency, privilege escalation, and AI supply-chain compromise. Partner with Secure AI, Application Security, and Cloud Security teams to continuously improve AI runtime visibility, monitoring, and protection capabilities. **4. Managing Cyber Defense Center (CDC) Capability and Operational Leadership** - Own and operate a 24x7x365 CDC with tiered analyst structure (L1/L2/L3) and MSP augmentation, ensuring continuous monitoring, detection, and response coverage across all enterprise and client-delivery environments globally. - Establish and enforce CDC performance standards including SLA targets for MTTD - Drive continuous CDC maturity improvement using SOC-CMM (SOC Capability Maturity Model), MITRE ATT&CK-based coverage assessments, and formal capability benchmarking against industry peers. - Manage CDC shift schedules, analyst burnout prevention programs, knowledge management (runbooks, wiki, playbook library), and cultural initiatives to sustain high-quality, 24x7 operations. **5. Detection Engineering and AI-Native Threat Detection** - Lead the detection engineering to develop, testing, tuning, and maintaining detection rules, correlation logic, and behavioral analytics across Nextgen SIEM (Microsoft Sentinel), EDR, and cloud-native platforms. - Implement a detection-as-code methodology, version-controlling all detection content in Git, integrating detection rule CI/CD pipelines, and enabling peer review of detection logic before deployment to production. - Map detection coverage to both MITRE ATT&CK (cloud matrix, enterprise matrix) and MITRE ATLAS (AI-specific techniques), identifying and closing coverage gaps across all TTPs relevant to the organization’s data and AI threat profile. - Drive adoption of AI/ML-powered detection capabilities, including anomaly detection