Sr Director, Cybersecurity Defense & Response (Hybrid - Dallas TX)

Company Description

Work with Us. Change the World.

At AECOM, we're delivering a better world. Whether improving your commute, keeping the lights on, providing access to clean water, or transforming skylines, our work helps people and communities thrive. We are the world's trusted infrastructure consulting firm, partnering with clients to solve the world’s most complex challenges and build legacies for future generations.

There has never been a better time to be at AECOM. With accelerating infrastructure investment worldwide, our services are in great demand. We invite you to bring your bold ideas and big dreams and become part of a global team of over 50,000 planners, designers, engineers, scientists, digital innovators, program and construction managers and other professionals delivering projects that create a positive and tangible impact around the world.

We're one global team driven by our common purpose to deliver a better world. Join us.

Job Description

The Sr Director, Cyber Defense & Response , will lead the day-to-day operations and continued evolution of the organization's Cyber Incident Response program, Global Cyber Security Operations Center and Managed Extended Detection and Response (MxDR) services. The leader will be accountable for a timely and effective response to security threats and incidents, for the performance of internal and third-party security operations providers, and for a threat-intelligence-led detection capability. The leader will also set and drive the strategy for applying AI to security operations, with appropriate governance and human oversight.

The role combines strategic ownership of the cyber defense roadmap and sourcing model with operational excellence, including measurable service levels, detection engineering and automation. The Sr Director is expected to be a subject matter expert in cyber forensics, industry best practices and incident response process.

This position will offer flexibility for a hybrid work schedule to include both in-office presence and virtual/remote work, to be based in Dallas, TX.

Responsibilities:

- Lead, manage and mature the people, process and technologies of a 24x7 global security operations center, including internal staff and managed service providers.
- Own the MxDR operating model: define requirements, lead vendor selection, transitions and renewals, and hold providers to service levels, remedies and cost targets.
- Direct detection engineering across SIEM, SOAR and EDR, including log source coverage, MITRE ATT&CK coverage and automation that reduces time to detect and respond.
- Define and lead the strategy for incorporating AI into the SOC, including AI-assisted triage, investigation and detection engineering and AI-enabled automation, with governance, guardrails and human oversight, and measure the results (for example, time to triage, time to respond and analyst workload).
- Evaluate and select AI capabilities from technology and managed service providers and hold providers accountable for AI-enabled service improvements and cost.
- Lead threat-intelligence-led operations, including threat intelligence, proactive threat hunting, and digital risk and dark web monitoring.
- Develop and direct the Enterprise Incident Response Program, ensuring continuous maturity.
- Collaborate with stakeholders such as Crisis Management and Business Continuity to support larger security initiatives, assessments and resilience testing.
- Define and maintain dashboards and metrics that support Incident Response Program and Cyber Security Operations Center maturity, and report performance to leadership.
- Manage the operating budget and vendor spend and build business cases for service and sourcing changes.
- Provide cyber security briefings, status updates and consultancy to technical and executive leadership audiences.
- Leverage the incident response program to conduct cyber tabletop simulations and educational sessions with stakeholders.
- Provide leadership for incident response investigations, coordinate response activity and brief senior leaders while maintaining confidentiality.

Management and Leadership

- Unwavering focus and crisis management skills, with the ability to manage relationships and communication channels.
- Exceptional written and verbal presentation skills; able to articulate complex technical issues concisely to both technical personnel and executive-level management.
- Exceptional leadership skills; able to lead, manage and grow a global cyber security operations center and incident response program.
- Operational excellence: demonstrated ability to run a service to defined metrics and service levels and to drive continuous improvement and automation.
- Advanced critical thinking and decision-making ability; able to explain and defend a complex decision point.
- Highly motivated and self-sufficient; able to operate autonomously within the scope of the role.

Qualifications

Minimum Requirements:

- BA/BS plus at least 14 years of relevant experience, or demonstrated equivalency of experience and/or education, plus at least 6 years of leadership experience
- In-depth experience leading security incident response processes in cloud, virtualized and on-premises environments.
- Extensive and direct experience in high-pressure situations managing and responding to complex technical cyber security incidents.
- Experience with SIEM, SOAR and EDR platforms, and with detection engineering practices.
- Working knowledge of AI and machine learning applied to security operations, including large language model and agent-based tools, and their risks (accuracy, data privacy, prompt injection, auditability).
- Understanding of current and emerging threats and countermeasures through relationships with cyber threat teams and vendors, including directing a team in applying threat intelligence to proactively mitigate risk.
- Develop and present accurate and timely information to stakeholders outlining technical solutions, recommendations and conclusions.
- Due to the nature of this position, US citizenship is required.

Preferred Qualifications

- Proven skills in elements of incident response, including computer intrusion investigations and digital forensics in enterprise environments.
- Strategic planning and commercial acumen, including sourcing strategy, vendor negotiation and financial management including MSSP management.
- Experience with similarly large, complex, global organizations

Additional Information

- Sponsorship for US work authorization is not available for this position, now or in the future

At AECOM, we are committed to maintaining a secure and trustworthy recruitment process and take any fraudulent hiring activity seriously. To support this commitment, all newly hired employees are required to attend an in-person Day 1 onboarding at an AECOM office location as a condition of employment.

About AECOM

AECOM is proud to offer comprehensive benefits to meet the diverse needs of our employees. Depending on your employment status, AECOM benefits may include medical, dental, vision, life, AD&D, disability benefits, paid time off, leaves of absences, voluntary benefits, perks, flexible work options ,  well-being resources, employee assistance program, business travel insurance, service recognition awards, retirement savings plan, and employee stock purchase plan.

AECOM is the global infrastructure leader, committed to delivering a better world. As a trusted professional services firm powered by deep technical abilities, we solve our clients’ complex challenges in water, environment, energy, transportation and buildings. Our teams partner with public- and private-sector clients to create innovative, sustainable and resilient solutions throughout the project lifecycle – from advisory, planning, design and engineering to program and construction management. AECOM is a Fortune 500 firm that had revenue of $16.1 billion in fiscal year 2025. Learn more at aecom.com.

What makes AECOM a great place to work

You will be part of a global team that champions your growth and career ambitions. Work on groundbreaking projects - both in your local community and on a global scale - that are transforming our industry and shaping the future. With cutting-edge technology and a network of experts, you’ll have the resources to make a real impact. Our award-winning training and development programs are designed to expand your technical expertise and leadership skills, helping you build the career you’ve always envisioned. Here, you’ll find a welcoming workplace built on respect, collaboration and community—where you have the freedom to grow in a world of opportunity.

As an Equal Opportunity Employer, we believe in your potential and are here to help you achieve it. All your information will be kept confidential according to EEO guidelines.