Vice President, Cyber Threat, Offensive Security & Incident Response (Hybrid)

At Globe Life, we are committed to empowering our employees with the support and opportunities they need to succeed at every stage of their career. We take pride in fostering a caring and innovative culture that enables us to collectively grow and overcome challenges in a connected, collaborative, and mutually respectful environment that calls us to help Make Tomorrow Better.

Role Overview:

Could you be our next Vice President, Cyber Threat, Offensive Security & Incident Response ? Globe Life is looking for a Vice President, Cyber Threat, Offensive Security & Incident Response to join the team!

In this role, you will be responsible for leading Globe Life’s enterprise cyber threat intelligence, offensive security, incident response, and continuous threat exposure management (CTEM) programs. As a member of the Chief Information Security Officer’s (CISO) leadership team, you will set the strategic vision for identifying and reducing cyber threats, direct the Company’s response to significant security incidents, and strengthen enterprise resilience. You will lead specialized cybersecurity teams, collaborate with executive leadership, and drive measurable improvements in threat detection, security control effectiveness, and organizational risk reduction.

This is a hybrid position located in McKinney, TX (WFH Monday & Friday, In Office Tuesday-Thursday).

What You Will Do:

Strategy, Governance, and Enterprise Accountability

• •Establish the strategic vision and a three-to-five-year operating model and investment roadmap for threat intelligence, offensive security, incident response, and exposure management, aligned with the CISO’s enterprise security strategy, risk appetite, and business priorities.
• •Hold enterprise-wide accountability for cybersecurity readiness and resilience outcomes, defining performance metrics for detection and containment, remediation of validated exposures within agreed timelines, detection coverage of priority threats, and control validation results, with targets established and reported to the CISO and executive leadership.
• •Own the policies, standards, and governance forums for incident response, offensive testing, and exposure management, helping shape enterprise security policies and risk appetite related to cyber threats and exposure risk.
• •Serve as a member of the CISO’s leadership team and the CISO’s delegate for cyber crisis matters when required.
• •Anticipate emerging threats and technological developments, including artificial intelligence (AI), and proactively adjust security strategies, capabilities, and investments.

Offensive Security

Define and lead a multi-year offensive security strategy and annual testing roadmap aligned with business priorities, enterprise risk appetite, and regulatory expectations, ensuring appropriate coverage of the Company’s most critical business services.

Direct red team operations, purple team exercises, penetration testing, and adversary emulation across applications, infrastructure, cloud environments, identities, and third-party connections, using MITRE ATT&CK to guide testing and evaluate security effectiveness.

Establish the governance for offensive security operations, including testing scope, rules of engagement, safety controls, success metrics, and approval processes for high-risk activities such as assumed breach and social engineering campaigns, in coordination with Legal, Privacy, and affected business owners.

Build and lead enterprise AI security testing capabilities, including red teaming of AI systems, large language model (LLM)-enabled applications, AI agents, and third-party AI services, covering prompt injection, data leakage, model abuse, insecure agent permissions, and supply-chain risks aligned with frameworks such as OWASP Top 10 for LLM Applications and MITRE ATLAS.

Partner with technology, data, and governance leaders to establish security testing requirements before AI capabilities reach production.

Establish safeguards for the safe and responsible use of AI and automation as force multipliers in offensive security operations.

Control Effectiveness Validation

• •Own the program for continuously testing whether security controls perform as designed and as rated, ensuring reported risk levels accurately reflect demonstrated control effectiveness.
• •Establish validation procedures with Information Security Risk so that standard testing results are incorporated into the risk register, including reassessment of associated risk ratings when controls fail and confirmation through retesting before ratings are lowered.
• •Lead recurring validation of critical detection and response controls through penetration testing, adversary emulation, and purple team exercises.
• •Partner with the Security Operations Center (SOC) and detection engineering teams to monitor improvement through detection and response coverage.
• •Provide evidence of control effectiveness to inform internal audit, external auditors, risk management, regulators, and the Board, serving as a senior point of contact for parties involved in testing and validation activities.

Threat Intelligence

Build, lead, and mature the enterprise cyber threat intelligence (CTI) program, delivering strategic, operational, and tactical intelligence on threats affecting Globe Life and the insurance and financial services industries.

Own the enterprise threat model and prioritized threat actor profiles covering ransomware, fraud-motivated actors, third-party and supply-chain compromise, and AI-enabled attack techniques, using these insights to guide security investments and priorities across the CISO organization.

Translate intelligence into actionable adversary emulation plans for red teams, threat hypotheses and detection requirements for the SOC, and exposure priorities for CTEM.

Track the exploitation of newly disclosed vulnerabilities, drive rapid assessment of Globe Life’s exposure, and escalate decisions to executive leadership when risk warrants.

Deliver clear, decision-ready threat briefings for the CISO, executives, and the Board.

Own intelligence sources and sharing relationships, representing Globe Life with the Financial Services Information Sharing and Analysis Center (FS-ISAC), federal and state law enforcement, and peer institutions to strengthen threat awareness and provide early warning during incidents.

Incident Response

Own the enterprise cyber incident response program, including response plans, playbooks, severity models, and escalation procedures for ransomware, data exfiltration, business email compromise, fraud, and AI system compromise, integrating response activities with enterprise crisis management, business continuity, and disaster recovery.

Serve as incident commander for significant cybersecurity incidents, coordinating IT, Legal, Privacy, Compliance, Communications, business units, and third-party responders to manage containment, investigation, and recovery.

Make time-critical containment decisions, including those affecting business operations, and escalate significant incidents to the CISO and executive leadership as defined by the severity model.

Partner with Legal, Compliance, and Finance leaders to support timely incident materiality assessments and regulatory notification decisions.

Oversee digital forensics and root cause analysis, coordinating the Company’s relationships and retainers with external incident response firms, forensic specialists, breach counsel, and cyber insurance carriers.

Run enterprise-wide tabletop exercises for technical teams, management, and executive leadership, using lessons learned to improve incident response readiness.

Ensure significant incidents result in documented corrective actions, assigned executive ownership, and follow-up activities that strengthen detection engineering, offensive testing, and CTEM priorities.

CTEM Program Operations

Set the strategy for, build, and operate Globe