Global Director of Autonomous Cyber Defense and Security Event Triage (SOC)

About this role

Do you want your voice heard and your actions to count?

Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.

With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.

Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.

The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.

The Global Director of Autonomous Cyber Defense and Security Event Triage leads the strategy, execution, and continuous improvement of a 24/7 global cyber defense and security event triage function. This role is accountable for globally protecting enterprise assets and services by driving outcomes across detection engineering, automated response, incident triage, and threat hunting. The director oversees global cyber operations performance, operating rhythms, and service delivery across multiple environments and partners, while owning budget planning and financial stewardship for the function. Additionally, the role advances autonomous defense capabilities by applying AI/ML and LLM-enabled workflows to improve alert quality, reduce time to detect/respond, and standardize decisioning, documentation, and remediation at scale. The director also ensures continuous validation of controls and detections through purple team execution aligned to adversary behaviors.

Major Responsibilities • Direct and mature a 24/7 global cyber operations model for security event monitoring, triage, incident response partnership, and threat hunting across multiple environments • Own functional strategy, multi-year roadmap, and KPI/OKR outcomes for autonomous cyber defense and security event triage (e.g., MTTD/MTTR, false-positive reduction, containment SLAs) • Work with the Global Head to define the vision for Autonomous Cyber Defense and Security Event Triage, and execute against that vision in alignment with the strategic design • Oversee budget planning, vendor management, and financial governance for global cyber operations tooling, services, and staffing; optimize spend to risk reduction and service performance • Lead, mentor, and scale high-performing global teams (employees and partners); define operating rhythms, coverage models, escalation paths, and on-call expectations • Serve as a lead escalation contact in a 24/7 environment; guide appropriate resources to resolution • Provide executive-level oversight for audit, risk, and regulatory engagements related to cyber operations; ensure processes, evidence, and metrics meet policy and compliance requirements • Deliver leadership reporting on cyber operations health, emerging threats, and risk posture; translate technical findings into business impact and prioritized actions • Drive AI/ML/LLM-enabled autonomous defense initiatives, including alert enrichment, case summarization, analyst co-pilots, automated containment, and continuous learning to improve signal-to-noise • Establish governance for detection engineering, triage decisioning, playbooks, and automation (SOAR/EDR/SIEM) to standardize response, reduce gaps, and improve response times • Lead critical incident triage and escalation governance; partner with incident response, infrastructure, identity, and application teams to coordinate containment and recovery • Oversee monitoring of third-party security service providers and managed tooling to ensure coverage, quality, and alignment to enterprise standards and SLAs • Build an operations analytics program to measure and continuously improve triage accuracy, response efficiency, backlog health, and automation effectiveness across regions and shifts • Sponsor and execute a purple team program (red/blue collaboration) to validate detections and response through adversary emulation aligned to MITRE ATT&CK; track gaps to closure • Oversee proactive threat hunting and continuous control validation to identify adversary behaviors, reduce dwell time, and harden critical services • Provide global operational leadership during cyber events by coordinating communications, handoffs, and technical execution across regions, functions, and time zones • Integrate threat intelligence, vulnerability insights, and attacker TTP research into detection logic, triage guidance, and autonomous response workflows • Produce and govern recurring and ad-hoc reporting on threats, trends, and program performance; ensure consistent narratives and decision support for stakeholders • Champion innovation and modernization of cyber defense tooling and techniques, including evaluation and adoption of new capabilities that measurably reduce risk • Partner with technology, product, and business leaders to align cyber operations priorities, drive remediation ownership, and embed security-by-design practices

Qualifications • Bachelor’s degree in Information Technology, Cyber Security, Computer Science, or related discipline or equivalent work experience • 7+ years of experience working in the Cybersecurity Operations or Information Security • Relevant technical and industry certifications, such as CISSP, ISSMP, GCIA, CISM, CEH, GCFA, GCFE, GCIH, or GSEC are preferred • Experience in one or more security domains including Security Governance and Oversight, Security Risk Management, Network Security, Threat and Vulnerability Management, or Incident Response and Forensics preferred • Experience with inform

Similar jobs

• Sr. Director, Cyber Threat Detection & Response — McKesson · Richmond, VA
• SOC Cyber Security Manager — GDIT · USA VA Falls Church
• Global Director of Autonomous Incident Response and Forensic Analysis — MUFG · Jersey City, NJ | Tempe, AZ
• Cybersecurity SOC Analyst II — Chaosindustries · Washington, District of Columbia, United States
• Cybersecurity SOC Analyst II — Chaosindustries · San Francisco, California, United States
• Cybersecurity SOC Analyst II — Chaosindustries · El Segundo, California, United States
• IT Audit, Cybersecurity & Risk Advisory Senior Consultant (SOC Focus) — Baker Tilly · USA TX Frisco
• Cybersecurity Incident Response Triage Analyst — Accenturefederalservices · Arlington, VA