Overview
ABOUT THE ROLE & TEAM
The CSIRT Director is a cybersecurity leader responsible for the complete ownership, strategy, and operational execution of the organization's enterprise Computer Security Incident Response Team (CSIRT).
The CSIRT Director operates at the strategic, operational, and tactical levels simultaneously, serving as the single point of accountability for all related cybersecurity response functions. This leader directs a globally distributed team across three operations center locations in Montreal (Canada), Cairo (Egypt), and Singapore, ensuring continuous, follow-the-sun security operations coverage.
This role reports directly to the Chief Information Security Officer (CISO) and serves as a key member of the cybersecurity leadership team, providing executive-level guidance on threat posture, incident trends, and operational risk.
WHAT YOU WILL DO
- Continuous Threat Exposure Management (CTEM) - Directs the organization's proactive exposure reduction program. This includes attack surface management, vulnerability prioritization, red team / purple team program oversight, penetration testing governance, and the coordination of remediation workflows with IT and engineering stakeholders.
- Cyber Threat Intelligence (CTI) - Commands the intelligence function responsible for producing finished, operationalized threat intelligence. This includes strategic intelligence briefings to CISO and Board, tactical intelligence feeds into detection platforms, threat actor tracking, sector-specific threat analysis (transportation/aviation/border security), and third-party intelligence partnerships.
- Incident Response (IR) - Owns the full incident response lifecycle. Accountable for IR planning and playbook governance, crisis management and executive communication during significant incidents, forensic capability oversight, tabletop exercise program, regulatory breach notification coordination, and post-incident reviews (PIRs).
- Security Operations (SecOps) Collaboration - Direct and optimize resources across global SOC locations (Montreal, Cairo, Singapore), ensuring consistent standards, 24/7/365 coverage through a followthesun operating model, and resilient business continuity with defined failover capabilities. Drive collaboration and intelligence sharing across sites while managing MSSP and thirdparty partners to ensure performance, accountability, and unified global operations.
- Strategic Leadership & Governance - Define and lead a multiyear global CSIRT strategy, serving as the single point of accountability for threat exposure, intelligence, and incident response while aligning capabilities to business risk and industry frameworks. Own executive reporting, budget planning, and the establishment of clear SLAs and KPIs to ensure a mature, scalable, and effective cybersecurity operations program.
- People Leadership & Talent Development - Lead, develop, and retain a highperforming global cybersecurity operations team across CTEM, CTI, and Incident Response, fostering an inclusive, highaccountability culture that enables collaboration across regions and time zones. Establish clear career pathways, performance management, and succession planning while overseeing staffing models, shift coverage, and oncall operations across all SOC locations.
- Executive & Stakeholder Engagement - Act as the primary liaison to the CISO, delivering executive and boardlevel insights on security operations, threat posture, and incident response effectiveness. Partner crossfunctionally with architecture, engineering, GRC, legal, and IT teams, and represent CSIRT in audits, regulatory reviews, and customer security engagements.
Qualifications
WHO YOU ARE
- 15+ years of progressive experience in cybersecurity, with at least 7+ years in a senior leadership role with direct accountability for security operations.
- 5+ years of direct experience managing large, geographically distributed Security Operations Centers (SOCs) including multi-site, multi-shift, 24/7/365 operations.
- Bachelor's degree in computer science, Information Systems, Information Security, or a related discipline; or equivalent professional experience.
- Active professional certification in at least one of the following: CISSP, CISM, CISA, GIAC GSOM, GIAC GCIH, or equivalent.
- Proven experience managing global teams across multiple time zones and cultures, with a track record of building cohesive, high-performing distributed teams. With demonstrated ownership of an Incident Response Function and Team.
- Demonstrated ownership of two or more of the following functions: SOC, CTEM / Vulnerability Management, Cyber Threat Intelligence,
- Strong command of the MITRE ATT&CK framework, NIST CSF, and incident response methodologies (SANS PICERL, NIST 800-61).
- Executive-level communication skills ability to translate complex technical threats into business risk language for CISO, C-suite, and Board audiences.
NICE TO HAVE
- Experience in the aviation, transportation, border security, or critical national infrastructure sectors.
- Hands-on background in threat hunting, malware analysis, digital forensics, or red team operations.
- Experience leading or overseeing a CTEM/BAS (Breach and Attack Simulation) program.
- Familiarity with security platforms including Elastic/Splunk SIEM, CrowdStrike/SentinelOne EDR, ServiceNow SecOps, Recorded Future or Mandiant Advantage CTI platforms.
- Proficiency in DevSecOps and cloud security principles (AWS, Azure, GCP) in the context of SOC monitoring.
- Experience with NIST 800-53, ISO 27001, PCI DSS, and SOC 2 compliance environments.
- Master's degree or Executive Education in Cybersecurity, Business Administration, or Risk Management.
WHAT WE OFFER
We’re all about diversity. We operate in 200 countries and speak 60 different languages and cultures. We’re really proud of our inclusive environment. Our offices are comfortable and fun places to work, and we make sure you get to work from home too. Find out what it's like to join our team and take a step closer to your best life ever.
🏡 Flex Week: Work from home up to 2 days/week (depending on your team’s needs)
⏰ Flex Day: Make your workday suit your life and plans.
🌎 Flex Location: Take up to 30 days a year to work from any location in the world.
🌿Employee Wellbeing: We’ve got you covered with our Employee Assistance Program (EAP), for you and your dependents 24/7, 365 days/year. We also offer Champion Health – a personalized platform that supports a range of wellbeing needs.
🚀 Professional Development: At SITA, we believe growth fuels innovation. Our learning ecosystem offers access to world-class platforms and programs designed to help you thrive. From LinkedIn Learning, Microsoft's Enterprise Skills Initiative, and Airport Council International -available to all employees-to specialized solutions like Pluralsight for technology upskilling, Harvard Business Publishing for people leadership, Stanford for strategic development and many others, we align learning opportunities with your Development Plan and our business priorities. Your development journey is supported every step of the way.
🙌🏽 Competitive Benefits: Competitive benefits that make sense with both your local market and employment status.
