Director - Incident Response and Threat Intelligence

Req ID: 397543

Competitive salary | Romania: remote possible

At NTT DATA, we know that with the right people on board, anything is possible. The quality, integrity, and commitment of our employees are key factors in our company’s growth, market presence and our ability to help our clients stay a step ahead of the competition. By hiring the best people and helping them grow both professionally and personally, we ensure a bright future for NTT DATA and for the people who work here.

NTT DATA is currently looking for a Director - Incident Response and Threat Intelligence for our growing team in Romania.

Role overview

The Director of Incident Response and Threat Intelligence is a Senior leadership position responsible for overseeing and managing all aspects of an organization’s security incidents and preventing events from becoming incidents. This role is crucial for safeguarding the organization’s data, systems, and infrastructure from cyber threats. The individual has direct and indirect management responsibility across cross-functional teams to respond to security incidents, sets strategic direction, and ensures the effective implementation of security measures to protect the confidentiality, integrity, and availability of the organization’s information assets.

Key Roles and Responsibilities:

Act as Global Incident Response Commander - Global Incident Response Commander’s key responsibilities include leading and coordinating the response to major incidents across a global organization, prioritizing incidents based on severity, managing resources, facilitating communication with stakeholders, developing and implementing an incident action plan, assigning roles and responsibilities within the team, and ensuring a timely and efficient response to minimize impact. This role also requires maintaining effective communication across different time zones and cultures.

Cybersecurity Incident Response (CSIRT):

• Leads and manages the organization’s CSIRT team.
• Develops and maintains incident response plans, playbooks, and procedures.
• Attack Surface Management: Monitor and maintain ASM alerting and implement processes to mitigate external threats.
• Coordinates and responds to security incidents, breaches, and vulnerabilities.
• Conducts post-incident analysis and continuous improvement.

Digital Forensics and Cybersecurity Investigations:

• Collects, processes, preserves, analyzes, and presents digital-related evidence to support vulnerability mitigation and/or investigations.
• Applies tactics, techniques, and procedures to a full range of tools and processes related to administrative, criminal, and counterintelligence gathering.

Incident Response for Physical Security Breaches:

• Develop and implement response plans for physical security incidents, ensuring swift and effective action.
• Coordinate with law enforcement and emergency services when necessary.

Collaboration with Cross-Functional Teams:

• Work closely with IT, HR, facilities management, and other departments to ensure physical security measures are aligned with overall organizational security strategies.

Acts as Global Threat Intelligence Commander whose primary responsibility is to oversee the collection, analysis, and dissemination of threat intelligence on a global scale, including identifying emerging threats, coordinating intelligence gathering across different regions, and providing actionable insights to decision-makers to proactively mitigate risks and respond to potential incidents.

Key responsibilities include:

• Overseeing the implementation and maintenance of threat intelligence platforms and tools to effectively collect, analyze, and distribute intelligence data.
  • Leading intelligence operations: Manage intelligence sources across regions, including open-source data, human intelligence, and technical sensors.
  • Threat analysis: Identify emerging threats, threat actors, TTPs, and their impact on global operations.
  • Strategic intelligence production: Develop high-level threat assessments and reports for executive decision-making.
  • Collaboration: Share threat intelligence within the organization and with external partners.
  • Incident response support: Provide real-time intelligence during security incidents.
  • Threat mitigation: Work with security teams on proactive measures, including security controls and training.
  • Talent management: Recruit, train, and mentor threat intelligence analysts.
  • Technology management: Implement and maintain threat intelligence platforms and tools.
  • Staying informed: Monitor evolving threats and adapt strategies accordingly.

Key considerations:

Global perspective:

• Understanding the geopolitical landscape and how different regions may be impacted by specific threats.

Data integration:

• Combining intelligence from diverse sources, including technical, human, and open-source data, to create a holistic picture of threats.

Communication skills:

• Effectively communicating complex threat intelligence to both technical and non-technical stakeholders.

Other responsibilities:

Providing Security-Related Advice and Guidance:

• Develops CSIRT and TI strategy that aligns with business objectives.
• Advises senior management and stakeholders on security matters.
• Ensures that Operations procedures and protocols are updated and comply with the industry’s best practices and legal requirements.

Security Governance and Compliance:

• Monitors compliance with security policies and regulatory requirements.
• Prepares for audits and assessments.

Leadership and Team Management:

• Interdepartmental Coordination:
  • Promote and manage interdepartmental coordination to ensure a unified security posture.
  • Facilitate regular meetings and communication between security teams and other organizational units.
• Establishes operational objectives for managers and teams.
• Builds and leads a high-performing security operations team.
• Provides mentorship, coaching, and professional development.

• Fosters a collaborative and inclusive work environment.

Knowledge, Skills and Attributes:

• Strong knowledge of security frameworks (ISO 27001, NIST, CIS).
• Excellent communication, collaboration, and problem-solving skills.
• Ability to balance technical expertise with business acumen.
• Ability to convey complex security concepts to non-technical stakeholders.
• Technical Knowledge:

• Cybersecurity: A deep understanding of cybersecurity principles, threats, and best practices. Familiarity with security frameworks such as NIST, ISO 27001, and CIS Controls.
• Network Security: Proficiency in securing networks, firewalls, intrusion detection/prevention systems, and VPNs.
• Application Security: Knowledge of secure software development practices, secure coding, and vulnerability assessment.
• Cloud Security: Understanding of cloud security architecture, identity and access management (IAM).
• Incident Response: Ability to lead incident response efforts during security breaches or incidents.

Essential Skills for a Global Incident Response Commander:

• Strong leadership and decision-making abilities
• Excellent communication and interpersonal skills
• Technical expertise in relevant systems and security practices
• Crisis management skills
• Ability to work under pressure and meet tight deadlines
• Cross-cultural awareness and sensitivity

Leadership and Management Skills:

• Strategic Thinking: The ability to align security initiatives with overall business goals.
• Team Management: Experience in leading and motivating security teams.
• Communication: Strong communication skills to convey complex security concepts to non-technical stakeholders.

Physical Security Knowledge:

• In-depth understanding of physical security principles, access control systems, and surveillance technologies.
• Familiarity with industry standards and best practices for physical security.

Compliance and Legal Knowledge:

• Regulatory Compliance: Familiarity with industry-specific regulations (e.g., GDPR, HIPAA, PCI DSS).
• Legal and Privacy Considerations: Understanding legal implications related to security and privacy.

Soft Skills:

• Leadership: Ability to inspire and guide security teams.
• Problem-Solving: Analytical skills to address security challenges.
• Adaptability: Staying updated with evolving security threats and technologies.
• Ethical Behavior: Upholding high ethical standards in security practices.

Academic Qualifications and Certifications:

• Bachelor’s degree in Computer science, Information Security, or related field
• Certified Protection Professional or Certified Fraud Examiner or equivalent internationally recognized qualification
• Relevant certifications (e.g. CISSP, CISM, CRISC, CEH, GIAC) are highly desirable.

Required Experience:

• Proven experience (15+ years) in information security, with at least 7+ years in a managerial/leadership role in an Incident Responder or commander role required.
• Expert knowledge of industrial security programs and the ability to identify and evaluate policies and procedures to complement the business objectives while protecting company personnel and assets.

Benefits

Our people are the most critical component of our long-term success and their health and wellbeing are our priority. You will enjoy a comprehensive, locally competitive benefits package.

About NTT DATA

NTT DATA is a $30 billion business and technology services leader, serving 75% of the Fortune Global 100. We are committed to accelerating client success and positively impacting society through responsible innovation. We are one of the world's leading AI and digital infrastructure providers, with unmatched capabilities in enterprise-scale AI, cloud, security, connectivity, data centers and application services. our consulting and Industry solutions help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have experts in more than 50 countries. We also offer clients access to a robust ecosystem of innovation centers as well as established and start-up partners. NTT DATA is a part of NTT Group, which invests over $3 billion each year in R&D.

Whenever possible, we hire locally to NTT DATA offices or client sites. This ensures we can provide timely and effective support tailored to each client’s needs. While many positions offer remote or hybrid work options, these arrangements are subject to change based on client requirements. For employees near an NTT DATA office or client site, in-office attendance may be required for meetings or events, depending on business needs. At NTT DATA, we are committed to staying flexible and meeting the evolving needs of both our clients and employees. NTT DATA recruiters will never ask for payment or banking information and will only use @nttdata.com, @nttdatafed.com and @talent.nttdataservices.com email addresses. If you are requested to provide payment or disclose banking information, please submit a contact us form, https://us.nttdata.com/en/contact-us.

NTT DATA endeavors to make https://us.nttdata.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact us at https://us.nttdata.com/en/contact-us. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications. NTT DATA is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status. For our EEO Policy Statement, please click here. If you'd like more information on your EEO rights under the law, please click here. For Pay Transparency information, please click here.