Director, Third-Party Cyber Defense

Job Description
The Director, Third-Party Cyber Defense is Allstate's senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look.

The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate's exposure and a stronger supplier ecosystem after every event.

As a Director, you won't just deliver results - you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.

A supplier just told us they've been breached.

It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:

• Do they have our data? Which data, about which customers, in which states.

• How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.

• What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.

• What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.

• What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don't call for it.

The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.

Building that capability is the job, and it's what we're building at Allstate.

What we're building

Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:

• A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.

• Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.

• Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.

• Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.

• A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.

• Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.

We need a leader who can bring these together and make them dependable at enterprise scale.

Why this matters

Allstate exists to protect people from life's uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it.

What Allstate can do for you

• A new function to build. You'll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team.

• Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers.

• Strong partners from day one. You'll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company.

• Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows.

What you can do for Allstate

• Build the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature.

• Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines.

• Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM's tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement.

• Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked.

• Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on.

• Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure each critical connection has a documented and tested cut-off procedure.

• Hear about trouble early. Lead continuous monitoring of critical suppliers and work with Threat Intelligence so supplier breach news reaches the team quickly. Extend that view to fourth parties and concentration risk.

• Draw clean lines with partners. Agree on who owns what with Enterprise TPRM and Procurement, Security Operations, Threat Intelligence, Exposure Management, and Legal & Privacy. This is a cyber function, not a second TPRM program.

• Measure progress. Report on time from supplier signal to triage, time to confirm our exposure, targeted technical assessments completed and handed to TPRM, and the percentage of critical connections with a tested cut-off, for leadership, the board, and regulators.

• Build and develop the team. Hire the leads for both teams, bring incident response, intelligence, and technical assessment skills together, and develop people who can move between them.

What you should bring with you

• 12+ years in cybersecurity across incident response, third-party cyber risk, or security operations, including 5+ years leading teams.

• Hands-on incident response experience, including incidents at suppliers or service providers where you had to get timely, accurate facts from an organization you do not control.

• Hands-on experience performing or leading technical security assessments of suppliers, and working knowledge of the third-party risk management lifecycle.

• Working knowledge of assessment frameworks and evidence, such as SOC 2, ISO 27001, SIG, and NIST CSF 2.0, and of continuous monitoring platforms.

• A technical understanding of how suppliers connect to a large enterprise: SaaS integrations, API and service accounts, B2B network links, managed file transfer, and managed service provider access.

• Experience in a regulated industry such as insurance, financial services, or healthcare, including working knowledge of obligations like NYDFS Part 500.

• A record of building a new function and scaling it into a repeatable, measurable program.

• Sound judgment under pressure and clear communication: telling Legal and business leaders what we know, what we don't, and what we recommend, and holding suppliers to what they owe us.

Skills
Cyber Incident Response, Data Connectivity, Executive Influence, Incident Response, People Leadership, Security Evaluations, Security Operations, Supply Chain Assessment, Technical Security

Compensation
Compensation offered for this role is 187,500.00 - 258,375.00 annually and is based on experience and qualifications.

Allstate provides a comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home also receive a monthly connectivity reimbursement to help offset internet costs.

When working from home, you must have a dedicated, private workspace free from distractions, along with appropriate desk and seating. Reliable internet is required, with minimum speeds of 50 MB download and 5 MB upload.

To help create a more personal and engaging experience, we ask that you join with your camera on if your interview is virtual. Please also have a Valid Photo Identification available at the start of your interview. If you require any accommodations or have questions ahead of your interview please reach out to your recruiter.

Note: Internal candidates are only asked to