Bachelor's degree in Information Security, Computer Science, Information Technology, Cybersecurity, or related field; Master's degree or MBA preferred.
15+ years of information security experience, with 8+ years in offensive security, cyber threat intelligence, or incident response.
8+ years of cybersecurity leadership experience, including managing multi-layer organizations with budget accountability.
Proven ability to influence senior executives and the Board on cybersecurity matters.
Experience in financial services, insurance, or highly regulated industries preferred.
Responsibilities
Establish strategic vision and operating model for cyber threat intelligence and incident response programs.
Direct red team operations and penetration testing across various environments.
Lead the enterprise cyber incident response program, coordinating across multiple teams during significant incidents.
Build and mature the enterprise cyber threat intelligence program, delivering actionable insights.
Set strategy for Continuous Threat Exposure Management (CTEM) program, ensuring timely identification and remediation of exposures.
Benefits
Hybrid work model with remote work options on Mondays and Fridays.
Opportunity to lead specialized cybersecurity teams and influence enterprise security strategy.
Engagement with executive leadership and the Board on critical cybersecurity issues.
Access to advanced tools and resources for cybersecurity operations.
Professional development opportunities in a rapidly evolving field.
Full Job Description
Role Overview:
Could you be our next Vice President, Cyber Threat, Offensive Security & Incident Response? Globe Life is looking for a Vice President, Cyber Threat, Offensive Security & Incident Response to join the team!
In this role, you will be responsible for leading Globe Life's enterprise cyber threat intelligence, offensive security, incident response, and continuous threat exposure management (CTEM) programs. As a member of the Chief Information Security Officer's (CISO) leadership team, you will set the strategic vision for identifying and reducing cyber threats, direct the Company's response to significant security incidents, and strengthen enterprise resilience. You will lead specialized cybersecurity teams, collaborate with executive leadership, and drive measurable improvements in threat detection, security control effectiveness, and organizational risk reduction.
This is a hybrid position located in McKinney, TX (WFH Monday & Friday, In Office Tuesday-Thursday).
What You Will Do:
Strategy, Governance, and Enterprise Accountability
Establish the strategic vision and a three-to-five-year operating model and investment roadmap for threat intelligence, offensive security, incident response, and exposure management, aligned with the CISO's enterprise security strategy, risk appetite, and business priorities.
Hold enterprise-wide accountability for cybersecurity readiness and resilience outcomes, defining performance metrics for detection and containment, remediation of validated exposures within agreed timelines, detection coverage of priority threats, and control validation results, with targets established and reported to the CISO and executive leadership.
Own the policies, standards, and governance forums for incident response, offensive testing, and exposure management, helping shape enterprise security policies and risk appetite related to cyber threats and exposure risk.
Serve as a member of the CISO's leadership team and the CISO's delegate for cyber crisis matters when required.
Anticipate emerging threats and technological developments, including artificial intelligence (AI), and proactively adjust security strategies, capabilities, and investments.
Offensive Security
Define and lead a multi-year offensive security strategy and annual testing roadmap aligned with business priorities, enterprise risk appetite, and regulatory expectations, ensuring appropriate coverage of the Company's most critical business services.
Direct red team operations, purple team exercises, penetration testing, and adversary emulation across applications, infrastructure, cloud environments, identities, and third-party connections, using MITRE ATT&CK to guide testing and evaluate security effectiveness.
Establish the governance for offensive security operations, including testing scope, rules of engagement, safety controls, success metrics, and approval processes for high-risk activities such as assumed breach and social engineering campaigns, in coordination with Legal, Privacy, and affected business owners.
Build and lead enterprise AI security testing capabilities, including red teaming of AI systems, large language model (LLM)-enabled applications, AI agents, and third-party AI services, covering prompt injection, data leakage, model abuse, insecure agent permissions, and supply-chain risks aligned with frameworks such as OWASP Top 10 for LLM Applications and MITRE ATLAS.
Partner with technology, data, and governance leaders to establish security testing requirements before AI capabilities reach production.
Establish safeguards for the safe and responsible use of AI and automation as force multipliers in offensive security operations.
Control Effectiveness Validation
Own the program for continuously testing whether security controls perform as designed and as rated, ensuring reported risk levels accurately reflect demonstrated control effectiveness.
Establish validation procedures with Information Security Risk so that standard testing results are incorporated into the risk register, including reassessment of associated risk ratings when controls fail and confirmation through retesting before ratings are lowered.
Lead recurring validation of critical detection and response controls through penetration testing, adversary emulation, and purple team exercises.
Partner with the Security Operations Center (SOC) and detection engineering teams to monitor improvement through detection and response coverage.
Provide evidence of control effectiveness to inform internal audit, external auditors, risk management, regulators, and the Board, serving as a senior point of contact for parties involved in testing and validation activities.
Threat Intelligence
Build, lead, and mature the enterprise cyber threat intelligence (CTI) program, delivering strategic, operational, and tactical intelligence on threats affecting Globe Life and the insurance and financial services industries.
Own the enterprise threat model and prioritized threat actor profiles covering ransomware, fraud-motivated actors, third-party and supply-chain compromise, and AI-enabled attack techniques, using these insights to guide security investments and priorities across the CISO organization.
Translate intelligence into actionable adversary emulation plans for red teams, threat hypotheses and detection requirements for the SOC, and exposure priorities for CTEM.
Track the exploitation of newly disclosed vulnerabilities, drive rapid assessment of Globe Life's exposure, and escalate decisions to executive leadership when risk warrants.
Deliver clear, decision-ready threat briefings for the CISO, executives, and the Board.
Own intelligence sources and sharing relationships, representing Globe Life with the Financial Services Information Sharing and Analysis Center (FS-ISAC), federal and state law enforcement, and peer institutions to strengthen threat awareness and provide early warning during incidents.
Incident Response
Own the enterprise cyber incident response program, including response plans, playbooks, severity models, and escalation procedures for ransomware, data exfiltration, business email compromise, fraud, and AI system compromise, integrating response activities with enterprise crisis management, business continuity, and disaster recovery.
Serve as incident commander for significant cybersecurity incidents, coordinating IT, Legal, Privacy, Compliance, Communications, business units, and third-party responders to manage containment, investigation, and recovery.
Make time-critical containment decisions, including those affecting business operations, and escalate significant incidents to the CISO and executive leadership as defined by the severity model.
Partner with Legal, Compliance, and Finance leaders to support timely incident materiality assessments and regulatory notification decisions.
Oversee digital forensics and root cause analysis, coordinating the Company's relationships and retainers with external incident response firms, forensic specialists, breach counsel, and cyber insurance carriers.
Run enterprise-wide tabletop exercises for technical teams, management, and executive leadership, using lessons learned to improve incident response readiness.
Ensure significant incidents result in documented corrective actions, assigned executive ownership, and follow-up activities that strengthen detection engineering, offensive testing, and CTEM priorities.
CTEM Program Operations
Set the strategy for, build, and operate Globe Life's organization-wide Continuous Threat Exposure Management (CTEM) program, ensuring exploitable exposures are identified, prioritized, validated, and addressed in a timely manner.
Lead threat-informed scoping activities to focus CTEM cycles on the attack surfaces and business services most likely to be targeted.
Partner with vulnerability management and attack surface management teams to define prioritization criteria and rank exposures based on exploitability and business impact rather than severity scores alone.
Direct validation activities using attack path analysis, automated penetration testing, and red team techniques to confirm which exposures are exploitable and which controls prevent or limit attacks.
Secure commitment from IT and business owners to remediate validated exposures within agreed timelines, resolve competing priorities, and escalate unresolved risks through appropriate risk acceptance processes.
Report exposure reduction, remediation progress, and program effectiveness to executive leadership, ensuring measurable improvements in the Company's security posture.
Enterprise Leadership and Executive Influence
Act as a trusted advisor to senior IT, infrastructure, application, and business leaders, securing enterprise-wide commitment to address validated cybersecurity risks, including situations where remediation competes with other business priorities.
Brief executive leadership on the threat landscape, significant incidents, and control effectiveness, translating technical security risks into business implications and recommendations that support informed decision-making.
Build, lead, and develop a high-performing, multi-layer cybersecurity organization across CTI, incident response, and offensive security, including managers and senior technical leaders.
Establish expectations for workforce planning, hiring, performance management, succession planning, career development, and team accountability.
Own the function's budget, tooling strategy, and external partnerships, including relationships with incident response retainers, testing firms, and intelligence providers.
Work within defined governance and financial controls, including vendor management, budget development, and demonstrated value from cybersecurity investments.
Collaborate with Information Security Risk and Information Security Architecture to ensure quality data supports risk assessments and that security control designs appropriately mitigate risks to required levels.
Partner with executive peers in Legal, Compliance, Privacy, Internal Audit, Enterprise Risk, Technology, Communications, and Human Resources to ensure a coordinated enterprise approach to cyber risk and crisis response.
What You Can Bring:
A bachelor's degree in Information Security, Computer Science, Information Technology, Cybersecurity, or a related field.
A master's degree in a related field or an MBA is preferred.
At least 15 years of information security experience, including eight or more years across offensive security, cyber threat intelligence, or incident response.
At least eight years of cybersecurity leadership experience, including five or more years managing managers and leading multi-layer organizations with budget accountability.
Demonstrated ability to influence senior executives and the Board and drive remediation outside direct reporting lines.
Experience in financial services, insurance, or another highly regulated industry is preferred.
Demonstrated experience as a senior leader or incident commander for major security incidents, including coordination with Legal, executives, regulators, and external responders.
Demonstrated experience setting multi-year cybersecurity strategies and building or transforming security functions with measurable improvements in outcomes.
Experience engaging regulators, auditors, law enforcement, or industry organizations such as FS-ISAC on cybersecurity matters.
Expert knowledge of incident response methodologies, frameworks, and best practices, including the NIST Cybersecurity Framework, SANS Incident Response, and ISO 27035.
Deep understanding of cyber threat landscapes, threat actor tactics, techniques, and procedures (TTPs), and attack frameworks such as MITRE ATT&CK.
Technical expertise in digital forensics, malware analysis, and investigative techniques across Windows, Linux, and cloud environments.
Comprehensive understanding of network protocols, security architectures, and enterprise IT infrastructure, including on-premises and cloud environments.
Knowledge of threat intelligence sources, platforms, and analysis techniques to identify and prioritize relevant threats.
Sound judgment and crisis leadership skills, with the ability to assess complex security incidents and make critical decisions under pressure with incomplete information.
Exceptional executive communication and Board-level presentation skills, with the ability to explain technical security incidents, threat information, and risk to executive, regulatory, and non-technical audiences.
Strong stakeholder management and influencing skills, with the ability to coordinate cross-functional efforts and secure commitment to remediation from leaders outside direct reporting lines.
Working knowledge of regulatory requirements and compliance standards applicable to financial services and insurance industries, including breach notification and incident materiality requirements.
Hands-on depth in red teaming, penetration testing, or adversary emulation, with working knowledge of MITRE ATT&CK.
Experience leading significant cybersecurity incidents from initial detection through containment, recovery, and post-incident improvement.
Experience building or running a threat intelligence function and translating intelligence into defensive actions.
Experience testing AI and LLM-based systems, including familiarity with OWASP Top 10 for LLM Applications and MITRE ATLAS.
Experience operating CTEM or exposure management programs, including attack path analysis, breach and attack simulation, and automated
