Associate Director DDIT ISC Detection & Response

About the role

The Detection and Response Associate Director plays a strategic role within the Novartis Cyber Security Operations Center (CSOC), a globally integrated security organization protecting Novartis against sophisticated and evolving cyber threats. The role combines technical expertise, strategic influence and AI-driven innovation to advance threat detection, investigation and incident response. It is a hybrid position based in Barcelona, Spain.

Key responsibilities

• Shape and influence global threat detection and response (TDR) strategy and act as a senior technical authority on complex security challenges and incident response.
• Drive AI adoption, intelligent automation and emerging technologies to transform detection and response.
• Lead strategic initiatives with global cybersecurity leadership, engineering teams and stakeholders.
• Oversee security monitoring, threat detection and triage across the IT ecosystem, using SIEM, advanced analytics and threat intelligence.
• Improve detection engineering, security controls and capabilities against evolving threat tactics, techniques and procedures.
• Serve as a senior escalation point for complex incidents and lead investigations, including forensic analysis, containment, stakeholder communication and remediation.
• Turn incident findings into recommendations and continuously improve TDR processes, investigation methodologies and response playbooks.
• Mentor security analysts, promote investigation quality and influence best practices across global TDR teams.

Required profile

• 8+ years of cybersecurity experience, including 5+ years in Security Operations, Threat Detection, Incident Response and Threat Hunting.
• Proven experience leading complex investigations and cross-functional initiatives in large enterprises.
• Track record of improving detection, incident response, operational efficiency and investigation quality.
• Experience mentoring analysts and influencing stakeholders without direct people management responsibility.
• Bachelor's degree (or equivalent experience).

Required skills

• Hands-on expertise with SIEM, EDR/XDR, Detection Engineering, Security Telemetry and tools such as Microsoft Sentinel, Microsoft Defender and Splunk.
• Cloud security investigations on Azure and/or AWS, including identity, endpoint and cloud telemetry.
• Use of MITRE ATT&CK, threat intelligence and attacker behavior analysis.
• Security automation, SOAR, KQL/SPL/Python scripting and AI-enabled SOC use cases.

What we offer

• Base salary range of 57,900 to 107,500 EUR, with a possible performance-based bonus.
• Flexible and hybrid working options where possible, and at least 14 weeks of paid parental leave.
• Insurance plans, retirement plans, wellbeing resources and global recognition programs.