McKesson

McKesson

Sr. Director, Cyber Threat Detection & Response

USA, VA, Richmond · Director

Sponsorship not specifiedDetected 112 days ago
GCPCloud PlatformsDevOpsCybersecuritySIEMSOARUEBASOC OperationsDetection EngineeringIncident ResponseStakeholder ManagementOKRsPerformance ManagementLeadershipCommunicationMentoringCISSP

Stay score

odds of building a lasting career here

42Risky
Cap-exempt (no lottery)0
Sponsors this role100
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Green-card filing pattern in this occupation

Context, not a finding about this posting: of this employer's 34 green-card filings in this occupation, 100% were for a worker who already held the job.

Green-card follow-through: 81%

Of 21 labor certifications old enough to have been used, 4 expired without the employer filing the next step. Median time from filing to decision: 484 days.100% of their filings were for a worker who already held the job.Only certifications past the 180-day window are counted — recent ones cannot have expired yet.

Files H-1B transfers

4 transfer filings in the last year, covering 4 workers. Median labor-condition decision: 22 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • This role requires strong technical depth in threat detection and response as well as the leadership maturity to operate at the executive level.
  • The Director establishes TDR strategy, roadmaps, and success metrics; governs an operating rhythm for detection coverage and remediation execution; and ensures outcomes are delivered across multiple teams (often via influence).

Responsibilities

  • Define and own the enterprise TDR strategy and operating model (detection engineering, alerting standards, response readiness, and remediation governance) aligned to business risk and technology priorities.
  • Lead selection, adoption, and lifecycle management of detection and response tooling and telemetry (SIEM, EDR/XDR, SOAR, UEBA, threat intel integrations, cloud logging, and case management), including integration standards and data quality requirements.
  • Partner with Security Operations (SOC/CSIRT), threat intelligence, vulnerability management, and platform teams to ensure detections map to prioritized threats and that response playbooks and automation are effective and current.
  • Establish remediation governance to drive closure of systemic security gaps identified through incidents, threat hunting, purple teaming, and control validation
  • Drive enterprise telemetry and logging strategy in partnership with engineering and infrastructure: ensure critical systems are instrumented, logs are retained appropriately, and detections can be built and tuned against reliable data sources.
  • Lead and develop TDR talent (leaders, detection engineers, analysts) through hiring, coaching, performance management, and capability development
  • Manage cross-functional stakeholder relationships and communications (Technology leaders, risk/compliance, audit, legal/privacy as needed), translating technical risk into business impact and driving alignment on funding, priorities, and delivery commitments.
  • Provide governance for incident and post-incident remediation: ensure lessons learned translate into durable control improvements, and conduct regular exercises/tabletops to validate readiness and benchmark progress.
  • Establish remediation governance to drive closure of systemic security gaps identified through incidents, threat hunting, purple teaming, and control validation; ensure clear ownership, prioritization, timelines, and exception processes.

Requirements

  • 15+ years of cybersecurity experience with significant depth in threat detection, incident response, and security operations, including 10+ years leading teams and/or enterprise programs.
  • Hands-on and leadership experience with detection and response platforms and practices (SIEM content engineering, EDR/XDR, SOAR automation, threat intel integration, logging/telemetry pipelines, and case management).
  • Executive-ready communication and stakeholder management skills, including the ability to present risk, progress, and investment needs to senior leadership and influence decisions
  • Degree or equivalent experience.
  • Typically requires 15+ years of professional experience and 10+ years of diversified leadership, planning, communication, organization, and people motivation skills (or equivalent experience).
  • Experience establishing oversight metrics and operational rhythms (OKRs/KPIs, reporting, service reviews) and using data to improve alert quality, reduce noise, and accelerate remediation throughput.
  • Proven capability managing vendor relationships and service contracts for security tooling and managed services, including defining requirements and measuring performance against outcomes.
  • Strong understanding of privacy considerations and appropriate monitoring practices
  • Proven ability to drive remediation outcomes at scale establishing SLAs, clarifying ownership, prioritizing backlogs, and closing systemic gaps surfaced by incidents, hunts, and assessments.
  • Demonstrated ability to set strategy, secure organizational alignment/approvals, and deliver outcomes through multiple stakeholders (Security, Infrastructure, Cloud, Application/Product, and business teams).
  • Deep understanding of detection engineering, telemetry pipelines, and security analytics: SIEM content engineering, EDR/XDR detections, SOAR automation, threat intelligence integration, alert triage models, and case management workflows.

Skills

  • Education Requirements
  • Certification Requirements
  • About Medical-Surgical
  • McKesson Medical-Surgical (MMS) is a subsidiary and publicly reported segment of the McKesson Corporation.
  • Alternate Care markets are growing rapidly and MMS is proud to be a leader in this space.
  • Looking Ahead: A New Chapter for MMS
  • Career Level - M5

Compensation

  • We will also continue to be one of the largest medical-surgical distributors in the U.S., with over $11B in annual sales.

Benefits

  • Establish and report executive-level metrics and scorecards (e.g., detection coverage, alert quality, MTTD/MTTR, response readiness, remediation SLAs, risk reduction) and drive continuous improvement based on outcomes.

Company info

  • We are known for delivering insights, products, and services that make quality care more accessible and affordable.
  • If you want to be part of tomorrow's health today, we want to hear from you.
  • This separation would accelerate our mission and empower us to shape a future defined by customer-centricity, bold thinking and operational excellence.
Apply directly at McKesson →Create a free account for alerts like thisView McKesson immigration profile

This listing is sourced directly from McKesson's careers page and normalized into a canonical job model.