Director, Investigations and Innovation

The Role

This Director-level role in Global Security Services leads and matures Lumen’s Investigations and Innovation program — a primarily virtual team of 25 to 30 skilled advanced cyber investigators, certified digital forensics professionals, Red Team / Pen testers, and innovation engineers.

As an industry disrupter, Lumen sets the bar high. This leader drives the research and incubation of emerging security capabilities enterprise-wide, sustaining the established program while boldly leading in new directions; a security-practitioner background is preferred. The role is cross-functional, partnering with the Cyber Fusion Center, Cyber Incident Response Team, Black Lotus Labs, Fraud Management, Physical Security, Legal, and SMEs across IT, Network, and Product. The work is challenging and the pace intense, but trust is how we operate — so the right leader thrives where every challenge is a chance to innovate and we win together.

Location

This is a remote postion open to candidates based anywhere in the US.  

The Main Responsibilities

1. Advanced Cyber Investigations & Digital Forensics

• Run a world-class digital investigations and forensics capability staffed by certified professionals.
• Lead complex intrusion, insider-threat, and incident investigations across all Lumen environments.
• Ensure forensically sound evidence acquisition, preservation, chain of custody, and data recovery.
• Deliver clear, defensible findings and metrics to stakeholders.

2. Litigation, Legal & Law Enforcement Support

• Provide expert investigations and legal support: e-discovery, legal hold, and response to subpoenas and demands.
• Serve as trusted liaison to Legal, HR, and external law enforcement.
• Maintain evidentiary standards for legal, regulatory, and litigation proceedings.

3. Innovation & Emerging Capabilities

• Research, pilot, and prove emerging security technologies — AI/ML security, automation, and next-gen tooling — where bold ideas drive real innovation.
• Incubate new detection, threat-hunting, and defensive capabilities into repeatable programs.
• Partner with Security Engineering and the Cyber Fusion Center to operationalize innovations at scale.

4. Threat Hunting

• Mature a program of hypothesis-driven threat hunts.
• Ingest new and emerging threats, including 0-day vulnerabilities.
• Pivot rapidly based on real and hypothetical threat-actor activity.

5. Red Team

• Run Adversarial Cyber Emulation (ACE) engagements against Lumen’s incident response teams.
• Lead Purple Team exercises in collaboration with incident response.
• Conduct penetration tests of targeted applications by risk or compliance.

6. Engineering of Detection & Response Security Controls

• Choose the right security technology with Security Architecture.
• Cover Detection & Response across Endpoint, Network, and AI.
• Configure the Lumen security stack for cross-platform cohesion.
• Tune the log-ingest and SIEM platform so responders can ‘defend Lumen.

Other Responsibilities:

• Establish investigative processes, standards, and evidentiary rigor.
• Develop a training and certification framework so the team can build, learn, and lead.
• Drive tooling requirements and assess existing technologies.
• Hire, develop, and grow team members with flexibility, care, and opportunity.
• Lead Manager and Sr. Manager personnel; identify, develop, and delegate assigned projects.
• Continually realign services with business and product needs, where every voice guides our future.
• Advance the growing security operations organization — we win together.
• Build strong relationships with colleagues, peers, clients, and vendors.

What We Look For in a Candidate

Knowledgeable on the following platforms:

• Security platforms: Crowdstrike, Palo Alto, Tenable, Proofpoint, Extrahop, Splunk, Microsoft, RADIUS, and emerging AI.
• Forensics platforms: Cellebrite, Magnet AXIOM, EnCase / FTK, Nuix, and e-discovery tooling.

Required:

• Bachelor’s degree in a related field plus 7 years relevant experience, or equivalent.

Preferred:

• 10+ years in security, investigations, or operations
• Relevant security or forensics certifications
• Security clearance may be required
• Security industry certifications (examples)
• CISSP
• CRISC
• CISM
• GCFA
• GCFE
• EnCE
• Security+
• CEH
• ITIL Foundations

Compensation