{"id":3094939,"url":"https://alion.io/job/exl-vice-president-cyber-security-operations","title":"Vice President - Cyber Security (Operations)","company":{"id":38016,"name":"EXL","domain":"exlservice.com","url":"https://alion.io/company/exl","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":80,"open_postings":273,"ghost_share":0,"stale_share":0.996,"repost_share":0.004,"time_to_fill_p50_days":15,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"head","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Noida, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":21000,"max_usd":51000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":291},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"RAG","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-07-27T06:46:19Z","employer_posted_date":"2026-07-27","last_verified_at":"2026-10-31T16:18:17Z","board_verified":true,"closed_at":null,"days_open":96,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":95},"description":"We are seeking a forward-thinking Cyber Security Operations Leader to lead and transform EXL's global Cyber Defense Center capabilities across mission-critical Security Operations, Threat Detection, Incident Response, Threat Intelligence, Digital Forensics, Security Automation, AI Security Monitoring, and Security Operations Assurance.\nThis role is responsible for evolving EXL's Cyber Defense Center (CDC) into an intelligence-driven, automation-first, and AI-augmented security operations capable of protecting a distributed enterprise comprising of cloud-native systems, Domain Platforms, BPaaS environments, AI-powered solutions, and critical business operations enabling our clients in regulated industries including Insurance, Banking & Financial Services, Healthcare, Energy & Utilities, Travel and Transportation.\nThe successful candidate will strengthen modern detection and response capabilities across traditional Technologies, Engineering Systems, COTS, Cloud, SaaS, and AI ecosystems while strengthening cyber resilience, operational robustness, and executive visibility into emerging cyber risks.\nThis leader will partner closely with Enterprise Security, Cloud Security Engineering, and Application Security within the Cyber Security functions and with cross-functions of Cloud Infrastructure, Data & AI teams, Analytics & AI Services and business stakeholders to continuously improve EXL's security posture and operational resilience while enabling secure innovation and digital transformation.\n Security Posture Monitoring, Incident Response and Crisis Management\nDrive established enterprise Incident Response capability, including a dedicated Computer Incident Response Team (CIRT) with clearly defined roles, escalation procedures, and communication protocols for both internal and client-impacting incidents.\nDevelop, maintain, and regularly test comprehensive incident response playbooks covering the full spectrum of attack scenarios: ransomware, BEC, supply chain compromise, insider threats, DDoS, APT intrusions, data breaches, cloud credential compromise, AI model tampering, and client data exposure.\nServe as the executive incident commander during major security incidents (P1/P2), coordinating cross-functional response across Technology, Legal, Communications, HR, executive leadership, and Industry Security Business Partners for client-impacting events.\nLead post-incident reviews (PIRs) and blameless retrospectives, ensuring root cause analysis, lessons learned, and remediation actions are tracked to closure and fed back into detection engineering, cloud security, and application security (Pillar 6) improvement cycles.\nBuild and maintain a digital forensics capability for conducting investigations across endpoints, servers, cloud workloads, email systems, containers, and mobile devices\nEstablish relationships with external incident response retainers, law enforcement (FBI Cyber, CISA), and industry ISACs (FS-ISAC, H-ISAC, IT-ISAC) for coordinated threat response and intelligence sharing\n2. Threat Intelligence & Proactive Threat Hunting\nBuild and operationalize a Cyber Threat Intelligence (CTI) program that collects, analyzes, and disseminates actionable intelligence from OSINT, commercial feeds (Google Mandiant, CrowdStrike Intel), dark web monitoring, industry ISACs, and government advisories.\nEstablish a proactive threat hunting program with dedicated hunters who develop hypotheses based on threat intelligence, MITRE ATT&CK TTPs, and environmental anomalies to identify threats that evade automated detection - including cloud-native and AI-specific hunting scenarios.\n3. AI Security Operations and AI Threat Defense\nEstablish monitoring, detection, and response capabilities for AI-enabled applications, LLM platforms, AI agents, RAG architectures, model repositories, and AI runtime environments.\nDevelop detection coverage aligned to MITRE ATLAS, OWASP Top 10 for LLM Applications, and emerging AI threat frameworks\nLead operational readiness for AI-related incidents including prompt injection, model abuse, model theft, data leakage, excessive agency, privilege escalation, and AI supply-chain compromise.\nPartner with Secure AI, Application Security, and Cloud Security teams to continuously improve AI runtime visibility, monitoring, and protection capabilities.\n4. Managing Cyber Defense Center (CDC) Capability and Operational Leadership\nOwn and operate a 24x7x365 CDC with tiered analyst structure (L1/L2/L3) and MSP augmentation, ensuring continuous monitoring, detection, and response coverage across all enterprise and client-delivery environments globally.\nEstablish and enforce CDC performance standards including SLA targets for MTTD \nDrive continuous CDC maturity improvement using SOC-CMM (SOC Capability Maturity Model), MITRE ATT&CK-based coverage assessments, and formal capability benchmarking against industry peers.\nManage CDC shift schedules, analyst burnout prevention programs, knowledge management (runbooks, wiki, playbook library), and cultural initiatives to sustain high-quality, 24x7 operations.\n5. Detection Engineering and AI-Native Threat Detection\nLead the detection engineering to develop, testing, tuning, and maintaining detection rules, correlation logic, and behavioral analytics across Nextgen SIEM (Microsoft Sentinel), EDR, and cloud-native platforms.\nImplement a detection-as-code methodology, version-controlling all detection content in Git, integrating detection rule CI/CD pipelines, and enabling peer review of detection logic before deployment to production.\nMap detection coverage to both MITRE ATT&CK (cloud matrix, enterprise matrix) and MITRE ATLAS (AI-specific techniques), identifying and closing coverage gaps across all TTPs relevant to the organization’s data and AI threat profile.\nDrive adoption of AI/ML-powered detection capabilities, including anomaly detection for cloud API behaviors, entity behavior analytics (UEBA) for insider threats, LLM-assisted alert triage, and automated alert correlation to reduce false positive rates by 30%+ year-over-year.\nOversee the deployment, integration, and optimization of the enterprise SIEM platform (Microsoft Sentinel), EDR/XDR (CrowdStrike, Microsoft Defender), \nDevelop detection content specifically for AI/ML workload threats: anomalous GPU utilization patterns, unauthorized model weight access, training data exfiltration, inference API abuse, and agentic AI permission escalation.\n6. Security Automation & Orchestration (SOAR)\nLead the design and maturity of repetitive CDC workflows using Microsoft Sentinel and LogicApps to accelerate response times and improve analyst efficiency across the global SOC operation.\nDevelop and maintain automated playbooks for common alert types: phishing triage, malware detonation, account lockout, suspicious cloud API activity, BPaaS tenant isolation alerts, and AI workload anomaly alerts \nDevelop LLM-assisted automation capabilities, including natural language alert summarization, automated runbook generation from incident patterns, and AI-powered root cause analysis suggestions.\nMeasure and report on automation metrics including percentage of alerts auto-triaged, mean time saved per automated playbook, analyst capacity reclaimed through automation, and automation-driven false positive reduction.\n Metrics, Reporting & Executive Communication\nDevelop and maintain a comprehensive Cyber operations metrics and KPI framework, providing real-time dashboards and monthly/quarterly executive reports to the CISO, CIO, and board of directors.\nTranslate operational telemetry, threat data, and incident patterns into strategic risk narratives that inform executive decision-making, board-level risk discussions, and security investment prioritization.\nProduce client-facing security posture reports demonstrating CDC capabilities, incident response readiness, and compliance posture for client due diligence, RFP responses, and contractual attestations.\nManage the security operations budget ($5M-$12M+), including SOC staffing, MSSP contracts, SIEM/EDR/SOAR licensing, threat intelligence feeds, IR retainers, and training programs, demonstrating ROI on automation and tooling investments.\n7. Team Leadership and Organizational Development\nRecruit, develop, and retain a world-class security operations team of 20-35 professionals across CDC analysis, detection engineering, incident response, threat intelligence, forensics, and automation functions, supplemented by MSSP partners for L1 surge and off-hours coverage.\nEstablish a continuous training and certification program (SANS GIAC: GCIH, GCFA, GCIA, GCTI, GSOM; OSCP; BTL1/BTL2; CySA+; cloud security certs) and invest in hands-on training through cyber range exercises, CTF competitions, and AI-specific threat simulations\n Proven track record of managing major security incidents (ransomware, APT, data breach, cloud credential compromise) from detection through recovery in environments with 5,000+ employees or equivalent complexity\nStrong Understanding of Cyber Defense & Security Operations\nSecurity Operations\nIncident Response\nThreat Hunting\nThreat Intelligence\nDetection Engineering\nDigital Forensics\nSOAR\nCloud Security Operations\nAWS Security\nAzure Security\nGCP Security\nContainer Security\nSaaS Security\nAI Security Operations\nAI Runtime Security\nLLM Security Monitoring\nAgentic AI Security\nAI Threat Detection\nMITRE ATLAS\nAI Attack Simulation\n Frameworks & Standards\nMITRE ATT&CK\nMITRE ATLAS\nNIST CSF\nNIST AI RMF\nISO 27001\nSOC-CMM","description_format":"text","description_chars":9517,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Incident Response","AI Consulting & Integration","Analytics & BI Consulting"],"lifecycle":[{"event":"open","at":"2026-10-22T15:52:12Z"}],"visa":[],"liveness":{"score":9,"band":"cold","label":"Long shot","p_open":1,"p_active":0.331,"p_room":0.28,"age_days":95,"expected_fill_days":15,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/exl-vice-president-cyber-security-operations","json_url":"https://alion.io/job/exl-vice-president-cyber-security-operations.json","meta":{"generated_at":"2026-10-31T17:05:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26793,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":38016},"rest":"https://alion.io/mcp/rest/get_company?id=38016"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fexl-vice-president-cyber-security-operations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fexl-vice-president-cyber-security-operations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fexl-vice-president-cyber-security-operations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/exl-vice-president-cyber-security-operations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fexl-vice-president-cyber-security-operations"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3094939}},{"tool":"search_jobs","arguments":{"company":"exlservice.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3094939},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}