Lead, Security Operations at Genworth Financial in Richmond, VA

Job description

About Us At Genworth and CareScout, we’re on a mission to simplify and dignify the aging experience. The truth is, most of us will help a parent, spouse, family member, friend, or neighbor navigate aging and care at some point in our lives. We’ve been there ourselves. That’s why we’re building better ways to help people find, fund, and understand aging care all while being supported every step of the way. We’re a team of curious problem-solvers, compassionate listeners, and people who care about making a difference. We value diverse perspectives and are committed to fostering an inclusive culture where every team member feels respected, supported, and empowered to bring their authentic self. Our four values guide our strategy, our decisions, and our interactions: ● Make it human. We care about the people that make up our customers, colleagues, and communities. ● Make it about others. We do what's best for our customers and collaborate to drive progress. ● Make it happen. We work with intention toward a common purpose and forge ways forward together . ● Make it better. We create fulfilling purpose-driven careers by learning from the world and each other. If you’re looking to build a meaningful career while helping transform the aging experience for millions of families, we’d love to hear from you. POSITION TITLE Lead, Security Operations POSITION LOCATION This position is available to Virginia residents as Richmond, VA hybrid in-office applicants or remote applicants residing in North Carolina, Maryland, Virginia, DC Metro. * A Hybrid schedule of both Remote and In-Office days would be required if you reside within 50 miles of a Genworth | CareScout office with working hours targeting our core business hours of 9am-5pm EST. For applicants outside of the 50-mile radius there would be an expectation of travel, approximately 25%. YOUR ROLE As Lead, Security Operations at Genworth | CareScout, you will lead our Computer Security Incident Response Team (CSIRT) and coordinate broader cybersecurity incident response efforts across the enterprise. You will guide the team’s preparation and response—from planning, intelligence, and detection engineering to investigation and containment through recovery and lessons learned—to protect our information, minimize business disruption, and strengthen operational resilience. This role combines technical leadership with hands-on operational accountability. You will develop team capabilities, strengthen response plans and playbooks, and bring clear ownership, timely escalation, and effective communication to complex incidents. Partnering across Technology, business functions, and external providers, you will turn incident insights into practical improvements that keep our response capabilities aligned with evolving threats and business needs. What you will be doing Lead the Computer Security Incident Response Team (CSIRT), setting priorities, developing team capabilities, and establishing clear accountability for incident readiness and response. Direct cybersecurity incident response from initial triage and investigation through containment, eradication, recovery, and post-incident review. Coordinate broader incident response efforts across Cybersecurity, Technology, business teams, and external partners, ensuring clear ownership, timely escalation, and effective handoffs. Maintain and enhance incident response plans, playbooks, severity criteria, and escalation procedures to support consistent execution. Serve as a primary escalation point for significant cybersecurity incidents, translating technical findings into clear business impacts, response options, and leadership updates. Partner with Legal, Privacy, Compliance, Risk, Communications, and Business Continuity teams to support incident decisions, notification assessments, and recovery coordination Guide incident investigations, including evidence preservation, forensic analysis, and documentation, engaging specialized internal resources and