Director, Cyber Detection & Response

<p><b><i>What Cybersecurity Defense contributes to Cardinal Health</i></b></p><p>Cybersecurity Defense focuses heavily on threat detection, incident response, and implementing security measures to protect our digital assets and infrastructure at Cardinal Health. The <i>Director, Cyber Detection & Response</i> is responsible for establishing, leading, and continuously enhancing cybersecurity detection, monitoring, and incident response capabilities to protect the organization from evolving cyber threats. Furthermore, this leader oversees Security Operations Center (SOC) operations, cyber threat detection, incident response, threat intelligence, and security testing functions to enable rapid identification, containment, and remediation of cybersecurity threats. This role plays a critical role in driving proactive defense strategies, improving detection and response capabilities, and ensuring alignment with risk and resilience objectives.</p><p></p><p><b>Location </b>- Open to candidates nationwide working in a fully remote capacity, with preference towards those based in Central or Eastern time zones (willingness to travel into our Corporate HQ in Dublin, OH during certain period of the year is a plus)</p><p></p><p><b>Responsibilities</b></p><ul><li>Develop and lead the cybersecurity detection and response strategy aligned with enterprise risk, threat landscape, and business priorities.</li><li>Establish governance frameworks and operating models for SOC, incident response, and threat management functions.</li><li>Serve as an advisor to leadership on threat trends, detection capabilities, and response readiness.</li><li>Drive continuous improvement of detection and response capabilities to address evolving threats and business needs.</li><li>Oversee SOC operations, including security logging, monitoring, alerting, and incident triage across the environment.</li><li>Oversee effective use of SIEM platforms to analyze correlated events, detect anomalies, and escalate potential incidents.</li><li>Lead the development and optimization of detection use cases, analytics, and monitoring strategies to improve visibility across the environment.</li><li>Oversee monitoring capabilities across IT and OT environments, ensuring coverage of critical systems and infrastructure.</li><li>Lead detection engineering and security tooling functions, including SIEM, SOAR, EDR, UEBA, and DLP capabilities.</li><li>Oversee the definition and implementation of use cases, rules, and configurations to improve automated detection, investigation, and response workflows.</li><li>Drive optimization and integration of security tools to enhance operational efficiency and reduce false positives.</li><li>Establish and lead threat intelligence capabilities to gather, analyze, and operationalize threat data from internal and external sources.</li><li>Oversee threat monitoring, analysis, and detection rule enhancement to proactively identify emerging threats.</li><li>Lead threat modeling activities to identify attack vectors, vulnerabilities, and control gaps across systems and processes.</li><li>Drive proactive threat hunting initiatives to identify hidden threats and indicators of compromise (IoCs) within the environment.</li><li>Lead enterprise incident response (IR) capabilities, including planning, testing, execution, and continuous improvement of IR processes.</li><li>Oversee incident response lifecycle activities including detection, triage, containment, eradication, and recovery.</li><li>Oversee incident response simulations and exercises to validate readiness and improve response effectiveness.</li><li>Enable effective coordination of incident response efforts across cybersecurity, IT, legal, and business stakeholders.</li><li>Manage breach notification processes and communication protocols for cybersecurity incidents.</li><li>Oversee digital forensics and investigative activities to determine the scope, root cause, and impact of cybersecurity incidents.</li><li>Ensure proper evidence collection, analysis, and documentation to support investigations and regulatory requirements.</li><li>Lead post-incident reviews and root cause analysis to strengthen detection and response capabilities.</li><li>Lead offensive and defensive security testing capabilities, including red teaming, penetration testing, and adversarial simulations.</li><li>Oversee blue team operations to detect, analyze, and respond to threats across enterprise environments.</li><li>Facilitate purple teaming activities to enhance collaboration between offensive and defensive teams and improve detection and response effectiveness.</li><li>Drive continuous improvement of security controls through testing, validation, and simulation exercises.</li><li>Collaborate with cybersecurity, IT, risk, legal, and business teams to integrate detection and response capabilities into enterprise operations.</li><li>Partner with architecture, engineering, and infrastructure teams to ensure detection and response requirements are embedded into system design and deployment.</li><li>Provide actionable insights and reporting to leadership on threat landscape, incident trends, and response effectiveness.</li><li>Support audit and regulatory activities by providing evidence and documentation related to detection and response processes</li><li>Define and track KPIs and KRIs related to detection, response, and operational performance.</li><li>Provide regular reporting to leadership on SOC performance, incident metrics, and threat trends.</li><li>Identify opportunities to enhance detection coverage, reduce response times, and improve operational efficiency.</li><li>Drive continuous improvement initiatives to mature detection and response capabilities.</li><li>Build and lead a high-performing cybersecurity detection and response team across SOC, IR, and threat management functions.</li><li>Develop team capabilities through training, mentoring, and structured career development initiatives.</li><li>Foster a culture of accountability, collaboration, and continuous improvement.</li><li>Ensure alignment of team capabilities with evolving threat landscape and organizational needs.</li></ul><p></p><p><b>Qualifications</b></p><ul><li>Ideally targeting individuals with 10+ years of experience in cybersecurity, with a strong focus on detection, incident response, and security operations.</li><li>Deep expertise in SOC operations, SIEM, incident response, and threat intelligence a plus.</li><li>Experience leading cybersecurity operations teams and managing complex incident response activities, a strong preference.</li><li>Strong understanding of cybersecurity frameworks (e.g., NIST CSF) and regulatory requirements required.</li><li>Demonstrated ability to communicate technical concepts and risk insights to executive leadership.</li><li>Strong leadership, analytical, and problem-solving skills.</li><li>Experience in highly regulated industries, a plus</li><li>Experience with advanced analytics, automation, and AI-driven security operations, a strong preference</li></ul><p></p><p><i>#LI-LP</i></p><p><i>#LI-Remote</i></p><p></p><p><b>Anticipated salary range: </b>$135,400 - $208,100</p><p><b>Bonus eligible: </b>Yes</p><p><b>Benefits: </b>Cardinal Health offers a wide variety of benefits and programs to support health and well-being.</p><ul><li><p>Medical, dental and vision coverage</p></li><li><p>Paid time off plan</p></li><li><p>Health savings account (HSA)</p></li><li><p>401k savings plan</p></li><li><p>Access to wages before pay day with myFlexPay</p></li><li><p>Flexible spending accounts (FSAs)</p></li><li><p>Short- and long-term disability coverage</p></li><li><p>Work-Life resources</p></li><li><p>Paid parental leave</p></li><li><p>Healthy lifestyle programs</p></li></ul><p></p><p><b>Application window anticipated to close:</b> 07/01/2026 *if interested in opportunity, please submit application as soon as possible.</p><p></p><p>The salary range listed is an estimate. Pay at Cardinal Health is determined by multiple factors including, but not limited to, a candidate’s geographical location, relevant education, experience and skills and an evaluation of internal pay equity.</p><p style="text-align:inherit"></p><p style="text-align:inherit"></p><p><i>Candidates who are back-to-work, people with disabilities, without a college degree, and Veterans are encouraged to apply.</i><i> </i></p><p></p><p><i>Cardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal <span><span style="overflow-wrap: break-word; display: inline; text-decoration: inherit; hyphens: auto;">Opportunity/Affirmative</span></span> Action employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity/expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law.</i></p><p><i>To read and review this privacy notice click </i><a href="https://www.cardinalhealth.com/content/dam/corp/email/documents/corp/cardinal-health-online-application-privacy-policy.pdf" target="_blank" rel="noopener noreferrer">here</a></p>

Back to blog

Common Interview Questions And Answers

1. HOW DO YOU PLAN YOUR DAY?

This is what this question poses: When do you focus and start working seriously? What are the hours you work optimally? Are you a night owl? A morning bird? Remote teams can be made up of people working on different shifts and around the world, so you won't necessarily be stuck in the 9-5 schedule if it's not for you...

2. HOW DO YOU USE THE DIFFERENT COMMUNICATION TOOLS IN DIFFERENT SITUATIONS?

When you're working on a remote team, there's no way to chat in the hallway between meetings or catch up on the latest project during an office carpool. Therefore, virtual communication will be absolutely essential to get your work done...

3. WHAT IS "WORKING REMOTE" REALLY FOR YOU?

Many people want to work remotely because of the flexibility it allows. You can work anywhere and at any time of the day...

4. WHAT DO YOU NEED IN YOUR PHYSICAL WORKSPACE TO SUCCEED IN YOUR WORK?

With this question, companies are looking to see what equipment they may need to provide you with and to verify how aware you are of what remote working could mean for you physically and logistically...

5. HOW DO YOU PROCESS INFORMATION?

Several years ago, I was working in a team to plan a big event. My supervisor made us all work as a team before the big day. One of our activities has been to find out how each of us processes information...

6. HOW DO YOU MANAGE THE CALENDAR AND THE PROGRAM? WHICH APPLICATIONS / SYSTEM DO YOU USE?

Or you may receive even more specific questions, such as: What's on your calendar? Do you plan blocks of time to do certain types of work? Do you have an open calendar that everyone can see?...

7. HOW DO YOU ORGANIZE FILES, LINKS, AND TABS ON YOUR COMPUTER?

Just like your schedule, how you track files and other information is very important. After all, everything is digital!...

8. HOW TO PRIORITIZE WORK?

The day I watched Marie Forleo's film separating the important from the urgent, my life changed. Not all remote jobs start fast, but most of them are...

9. HOW DO YOU PREPARE FOR A MEETING AND PREPARE A MEETING? WHAT DO YOU SEE HAPPENING DURING THE MEETING?

Just as communication is essential when working remotely, so is organization. Because you won't have those opportunities in the elevator or a casual conversation in the lunchroom, you should take advantage of the little time you have in a video or phone conference...

10. HOW DO YOU USE TECHNOLOGY ON A DAILY BASIS, IN YOUR WORK AND FOR YOUR PLEASURE?

This is a great question because it shows your comfort level with technology, which is very important for a remote worker because you will be working with technology over time...