Director, Enterprise Security - Virta Health

Virta Health is on a mission to reverse metabolic disease in one billion people. Current treatment approaches aren’t working—over half of US adults have either type 2 diabetes or prediabetes, and obesity rates are at an all-time high. Virta is changing this by helping people reverse their metabolic condition through innovations in technology, personalized nutrition, and virtual care delivery reinvented from the ground up.

As our Director of Enterprise Security, you'll have the rare opportunity to build and shape Virta's security operations function. This is a player-coach role: early on, you'll be hands-on in investigations, detections, and tooling alongside the team, while setting the standards, structure, and direction the function will grow into.

Responsibilities

• Hands-on Engineering & Operational Leadership: Direct, mentor, and grow a high-performing security operations team. Conduct technical sprint planning, alignment, and coaching while maintaining the technical depth to dive into configurations alongside your team.
• Build the Enterprise Security Function: Shape the team's structure, hiring plan, and long-term roadmap as we grow, including decisions about where to build in-house, where to partner, and how to invest our security budget for greatest impact.
• Define SOC Operating Model: Decide whether we operate in a hybrid or internal model, and design the coverage, on-call, escalation paths, and metrics we use to measure effectiveness.
• Own Detection Engineering & Observability: Design and tune detections as code, ensuring version control and testing, across all security platforms.
• Lead Technical Incident Response: Own the management of security incidents from triage through post-incident review, inter-team collaboration, and resolution.
• Perform Hands-on Investigations: Work investigations directly, from log analysis and triage to tracking down identity, cloud, SaaS, and endpoint concerns.
• Manage & Minimize Blast Radius: Build and evolve automated response capabilities—leveraging threat models and SOAR orchestration—to neutralize threats before they spread.
• Lead Security Platform Strategy: Own the platforms that give us security visibility across our systems (CASB, CSPM, CNAPP, and more), and keep them tuned as threats change.
• Validate Defenses: Run recurring testing and informed adversary emulation to confirm our posture and the effectiveness of detection and mitigation responses.
• Vendor & Compliance Integration: Establish clear security expectations for enterprise systems, leading vendor evaluations including BAA requirements and HITRUST/SOC 2 assurance expectations.
• Design AI-Assisted Capabilities: Develop context, tools, and guidance to provide security operations the ability to stitch together disparate data effectively.
• Partner with GRC: Work closely with the GRC team to automate evidence collection and generation across security platforms, mapping to relevant controls.

90-Day Plan

• First 30 Days: Deep dive into Virta’s cloud systems and existing security platforms. Establish collaborative, high-trust relationships with your engineering team, IT, and GRC peers. Conduct an assessment of security operations capabilities.
• Days 30–60: Develop your roadmap for the next six months, using your assessment to decide where to formalize and strengthen security operations standards and processes.
• Days 60–90: Start delivering on the roadmap, prioritizing improvements that reduce manual work and strengthen detection and response. Create a security operations maturity dashboard and present it to executive leadership.

Must-Haves

• 10+ years in security operations, detection and response, or cloud security, including 3+ years leading or mentoring technical security teams.
• Hands-on incident response experience across logs, endpoints, identity, cloud, and SaaS, with a track record of leading incidents from triage to post-review.
• Experience writing and maintaining detection rules in a detection-as-code model, with a solid understanding of coverage frameworks like MITRE ATT&CK.
• Strong scripting or programming skills (e.g., Python, Go) and a track record of building internal tools, integrations, or automation.
• Deep experience owning and tuning security platforms such as SIEM, EDR/XDR, CSPM, and SOAR.
• Hands-on cloud security experience, ideally in GCP with containerized workloads.
• Practical experience applying AI to security or operational work beyond basic prompting.
• Clear communication skills to explain technical risk and security strategy to executives, engineering teams, and vendors.