{"id":3233271,"url":"https://alion.io/job/novartis-associate-director-ddit-isc-detection-response","title":"Associate Director DDIT ISC Detection & Response","company":{"id":5824,"name":"Novartis","domain":"novartis.com","url":"https://alion.io/company/novartis","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":79,"open_postings":63,"ghost_share":0,"stale_share":0.825,"repost_share":0.032,"time_to_fill_p50_days":30,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"head","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Barcelona, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":57900,"max":107500,"currency":"EUR","period":"year","gross":null,"usd_annual":120446},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-23T00:00:00Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-25T13:42:02Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Salary Range:\n€57,900.00 - €107,500.00Job Description Summary\nThe Detection and Response Associate Director will play a strategic role within the Novartis Cyber Security Operations Center (CSOC), a globally integrated security organization dedicated to protecting Novartis against sophisticated and evolving cyber threats.This position combines deep technical expertise, strategic influence, and AI-driven innovation to advance global threat detection, investigation, and incident response capabilities. The role will drive operational excellence, champion emerging technologies and intelligent automation, and contribute to the continuous evolution of cyber defense at Novartis.\nWorking closely with global cybersecurity leadership, engineering teams, and key business stakeholders, the Associate Director will lead strategic initiatives, strengthen cyber resilience, and drive meaningful improvements across security operations. The position is designed for an experienced cybersecurity professional passionate about solving complex challenges, advancing innovation, and delivering measurable security impact.\nJob Description\n#LI-Hybrid\nLocation: Barcelona, Spain\nKey Responsibilities:\nShape and influence global TDR strategy, driving operational excellence, innovation, and advanced cyber defense capabilities. Serve as a senior technical authority, providing strategic guidance on complex security challenges and critical incident response activities.\nDrive AI adoption, intelligent automation, and emerging technologies to transform detection and response capabilities.\nLead strategic initiatives in collaboration with global cybersecurity leadership, engineering teams, and key stakeholders.\nOversee and enhance security monitoring, threat detection, and triage capabilities across the Novartis IT ecosystem. Leverage SIEM, advanced analytics, and threat intelligence to identify sophisticated threats and improve detection coverage.\nDrive improvements in detection engineering, security controls, and capabilities against evolving TTPs.\nServe as a senior escalation point for complex security incidents involving sophisticated threat actors.\nLead critical investigations and response activities, including forensic analysis, containment, stakeholder communication, and remediation.\nTranslate incident findings into actionable recommendations to strengthen organizational cyber resilience.\nDrive continuous improvement of TDR processes, investigation methodologies, and response playbooks. Collaborate with engineering teams to advance security orchestration, automation, and technology integration.\nProvide technical mentorship, promote investigation quality, and influence best practices across global TDR teams.\n\nEssential Requirement:\n8+ years of cybersecurity experience, including 5+ years in Security Operations, Threat Detection, Incident Response, and Threat Hunting.\nProven experience leading complex security investigations and driving cross-functional initiatives in large enterprise environments.\nStrong track record of enhancing detection capabilities, incident response processes, operational efficiency, and investigation quality.\nExperience mentoring security analysts and influencing stakeholders across teams without direct people management responsibility.\nHands-on expertise with SIEM, EDR/XDR, Detection Engineering, Security Telemetry, and Incident Response tools such as Microsoft Sentinel, Microsoft Defender, and Splunk.\nSolid knowledge of cloud security investigations across Azure and/or AWS, including identity, endpoint, and cloud telemetry analysis.\nSkilled in leveraging MITRE ATT&CK, threat intelligence, and attacker behavior analysis to improve detection and response strategies.\nProficiency in security automation, SOAR, KQL/SPL/Python scripting, AI-enabled SOC use cases, with a Bachelor's degree (or equivalent experience). \nDesirable Requirement:\nCertifications such as CISSP, GCIH, GCFA, or cloud security certifications preferred.\nBenefits & Rewards\nAt Novartis, we’re committed to reimagining medicine together - and rewarding the people who make it happen.\nExpected Annual Base Salary Range for role: 57,900.00 - 107,500.00 EUR\nThe base salary offered is determined based on gender-neutral objectives, such as relevant skills, competencies and experience in accordance with the Novartis pay setting policy and upon joining Novartis will be reviewed periodically.\nIn addition to your base salary, you may be eligible for a performance-based bonus depending on certain performance parameters.\nThe rewards of being part of our team go far beyond base pay and incentives. We also offer a variety of competitive benefits in kind to help you thrive personally and professionally, such as insurance plans, retirement plans, wellbeing resources and global recognition programs. In addition, we provide flexible and hybrid working options, where possible, and minimum 14 weeks paid parental leave.\nPay equity is a fundamental principle of our employment policy and reflects our commitment to create a diverse, equitable and inclusive environment that treats all employees with dignity and respect, as outlined in our Code of Ethics.\nRead our brochure to learn more about our global total rewards offering:\nhttps://www.novartis.com/sites/novartis_com/files/novartis-life-handbook.pdf\nNote: Benefits and compensation may vary by country and are subject to local legal requirements, including provisions of collective bargaining agreements where applicable. A full overview of your compensation package, including any relevant collective bargaining agreement details applicable to your role based on your employment location and Novartis employer entity, will be communicated separately to you during the application process.\nCommitment to Diversity and Inclusion / EEO\nNovartis is committed to building an outstanding, inclusive work environment and diverse teams’ representative of the patients and communities we serve.\nYou’ll receive: You can find everything you need to know about our benefits and rewards in the Novartis Life Handbook. https://www.novartis.com/careers/benefits-rewards Commitment to Diversity and Inclusion: Novartis is committed to building an outstanding, inclusive work environment and diverse teams' representative of the patients and communities we serve.\nSkills Desired\nCommunication, Cybersecurity Compliance, Cyber Threat Hunting, Cyber Threat Intelligence, Cyber Threat Prevention, Decision Making, Digital Capabilities, Influencing Skills, Information Security Risk Management, Technology Use, Vulnerability Management","description_format":"text","description_chars":6588,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Hybrid work","Parental leave","Retirement plans"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Oncology Therapeutics","Neurology & CNS Therapeutics","Immunology & Inflammation Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-25T09:26:47Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":30,"reasons":["conf:10","win:early","comp:brand"],"computed_at":"2026-10-25T23:52:51Z"},"pay":{"stated_usd_annual":120446,"is_top_pay":false},"html_url":"https://alion.io/job/novartis-associate-director-ddit-isc-detection-response","json_url":"https://alion.io/job/novartis-associate-director-ddit-isc-detection-response.json","meta":{"generated_at":"2026-10-25T23:52:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33775,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5824},"rest":"https://alion.io/mcp/rest/get_company?id=5824"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnovartis-associate-director-ddit-isc-detection-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnovartis-associate-director-ddit-isc-detection-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnovartis-associate-director-ddit-isc-detection-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/novartis-associate-director-ddit-isc-detection-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnovartis-associate-director-ddit-isc-detection-response"}]}