Global Cybersecurity Director - Security Operations at Boston Consulting Group (BCG)

What You'll Do

Security Continuous Monitoring Oversight

• Establish and lead BCG’s first enterprise-wide Cybersecurity Continuous Monitoring (CSCM) program, ensuring continuous visibility into system, endpoint, network, and cloud activity.
• Define and implement governance models, including ownership of monitoring metrics (e.g., MTTD, MTTR, false positive rate, coverage completeness).
• Stand up monitoring processes and integrate telemetry sources across SIEM, EDR, identity, network, and cloud platforms.
• Ensure monitoring outputs are actionable, enriching detection and response activities and informing risk and compliance stakeholders.

Technical Architecture & Integration

• Design and implement a continuous monitoring reference architecture, leveraging SIEM, SOAR, UEBA, and threat intelligence.
• Establish enterprise logging standards covering log coverage, retention, encryption, access, and integrity requirements.
• Drive automation of monitoring workflows and correlation logic to reduce dwell time and improve detection accuracy.
• Collaborate with threat intelligence teams to ensure real-time enrichment of event data and alignment with MITRE ATT&CK adversary tactics.

Program & Capability Development

• Build the CCM capability from the ground up, defining the operating model, reporting cadence, and engagement with SOC, risk, and compliance.
• Develop and track KPIs, ensuring CCM effectiveness is measurable and communicated to senior stakeholders.
• Prioritize creation of top 5–10 operational dashboards and reports that provide critical enterprise visibility.
• Mature the function from initial operational capability (M1) toward advanced maturity, embedding continuous improvement cycles.
• Shape

STRATEGIC LEADERSHIP

• Serve as the founding leader for the CCM function, creating the strategy, roadmap, and tactical build plan.
• Partner with enterprise stakeholders across IT, Risk, and Security to align monitoring with business risk tolerance and resilience objectives.
• Influence senior leaders by translating technical telemetry insights into business-relevant intelligence.
• Build, inspire, and retain a high-performing team of analysts and engineers over time, leveraging both full-time staff and contractors.
• Advise senior leadership (via SecOPS) on monitoring-driven insights, risks, and mitigation recommendations.

What You'll Bring

• Bachelor’s degree (or equivalent). Master’s preferred.
• 10+ years in cybersecurity operations, with at least 5 years in security monitoring, SOC leadership, or equivalent detection & response functions.
• Proven track record of building or maturing monitoring capabilities (SIEM, SOAR, telemetry pipelines, UEBA, threat intel integration).
• Knowledge of log ingestion, normalization, correlation, and enrichment processes.
• Familiarity with leading monitoring technologies: Splunk, DataDog, Microsoft Defender, CrowdStrike Falcon, Azure/AWS/GCP telemetry, threat intelligence platforms.
• Expertise in metrics-driven monitoring: defining, tracking, and reporting MTTD, MTTR, false positive rates, and coverage completeness.
• Familiarity with frameworks like NIST CSF, MITRE ATT&CK, and ISO 27001, with experience applying these to monitoring.
• Experience in threat hunting, anomaly detection, and behavioral analytics.
• Strong leadership skills: able to recruit, mentor, and develop a high-performing team in a newly established function.
• Executive presence: able to present complex monitoring data and risks to senior leadership in clear, concise business terms.