Job description

We are the movers of the world and the makers of the future. We get up every day, roll up our sleeves and build a better world -- together. At Ford, we're all a part of something bigger than ourselves. Are you ready to change the way the world moves? Enterprise Technology plays a critical part in shaping the future of mobility. If you're looking for the chance to leverage advanced technology to redefine the transportation landscape, enhance the customer experience and improve people's lives, this is the opportunity for you. Join us and challenge your IT expertise and analytical skills to help create vehicles that are as smart as you are. This leadership role within the Vehicle and Connected Cybersecurity organization is responsible for leading operational monitoring and incident response for connected vehicle and cloud environments. You will lead a specialized team of Product Security Operations Center (PSOC) cybersecurity professionals in triaging alerts, coordinating investigations, and driving timely resolution across vehicle telematics, embedded systems, and cloud-native application stacks. Reporting to the Director of Monitoring and Threat Hunting, this role focuses on incident management, driving issue closure, and continuously improving Ford's monitoring processes and detection capabilities. As a peer to the Monitoring Global Team, you share equal ownership of Ford's day-to-day monitoring mission and its follow-the-sun operating model. You will partner across cloud, vehicle, and enterprise teams to ensure rapid, effective problem resolution for connected vehicles and the cloud services that power them. What you'll do... • Operational Monitoring and Incident Response: Direct daily PSOC operations including alert triage, incident coordination, containment, remediation, recovery, and closure. • Cloud & Embedded Investigation and Resolution: Lead investigations of security events across cloud application stacks and embedded vehicle architectures using available logging and telemetry. • People Leadership: Lead, mentor, and develop an established team of analysts, managing shift structure and operational readiness. • Global Coverage Partnership: Partner with the Monitoring Global team to sustain seamless follow-the-sun coverage, consistent standards, and robust cross-region handoff. • Operational Improvement and Feedback Loop: Provide structured feedback to the Monitoring Development team to identify friction points and improve detection logic, tooling, and response workflows. • Cross-Functional Partnership: Collaborate closely with the Cyber Incident Response Team (CIRT), Product Development, and Enterprise IT to execute response playbooks and coordinate complex mitigations. You'll have... • Bachelor’s degree in Computer Science, Cybersecurity, or Engineering, or related field OR a combination of education and experience. • 5+ years in cybersecurity including experience leading SOC, incident response, or security operations teams. • Deep understanding of incident response lifecycles, escalation management, and incident management practices. • Hands-on experience with cloud security operations on one or more major cloud platforms, including logging, monitoring, identity, and response workflows. • Experience investigating and responding to incidents in hybrid environments spanning cloud services, enterprise IT, and connected/embedded systems. • Experience partnering with engineering and infrastructure teams to triage, contain, and remediate production-impacting issues. • Proven ability to manage high-pressure security incidents, mentor technical teams, and communicate clearly with senior leadership. Even better, you may have... • Master’s degree preferred • 2+ years of people leadership or program leadership in SOC, cloud operations, or security engineering environments. • Prior experience leading teams in 24x7 operations, including shift handoff, incident prioritization, and operational readiness. • Familiarity with detecting and investigating threats across cloud and vehicle telemetry data, including log correlation and alert tuning. • Technical understanding of embedded or automotive environments and the security considerations of cloud architecture. • Background in building, refining, or operationalizing runbooks, playbooks, and escalation procedures at scale. • Relevant certifications such as CISSP, CISM, GIAC, or cloud security certifications across AWS, Azure, or GCP. • Ability to turn incidents into platform, process, or detection improvements. You may not check every box, or your experience may look a little different from what we've outlined, but if you think you can bring value to Ford Motor Company, we encourage you to apply! As an established global company, we offer the benefit of choice. You can choose what your Ford future will look like: will your story span the globe, or keep you close to home? Will your career be a deep dive into what you love, or a series of new teams and new skills? Will you be a leader, a changemaker, a technical expert, a culture builder…or all of the above? No matter what you choose, we offer a work life that works for you, including: • Immediate medical, dental, vision and prescription drug coverage • Flexible family care days, paid parental leave, new parent ramp-up programs, subsidized back-up childcare and more • Family building benefits including adoption and surrogacy expense reimbursement, fertility treatments, and more • Vehicle discount program for employees and family members and management leases • Tuition assistance • Established and active employee resource groups • Paid time off for individual and team community service • A generous schedule of paid holidays, including the week between Christmas and New Year’s Day • Paid time off and the option to purchase additional vacation time. For a detailed look at our benefits, click here: fordcareers.co This position is a range of salary grade Leadership Level 6: $132,800 – $250,800 *Note: This is a hybrid role, you are expected to relocate if you are not within commutable distance, and responsible to be on site 4 days a week Visa sponsorship is not available for this position. Candidates for positions with Ford Motor Company must be legally authorized to work in the United States. Verification of employment eligibility will be required at the time of hire. We are an Equal Opportunity Employer committed to a culturally diverse workforce. All qualified applicants will receive consideration for employment without regard to race, religion, color, age, sex, national origin, sexual orientation, gender identity, disability status or protected veteran status. In the United States, if you need a reasonable accommodation for the online application process due to a disability, please call 1-888-336-0660. #LI-Hybrid #LI-AH1

Requirements

Must-haves

What you'll do...
Operational Monitoring and Incident Response: Direct daily PSOC operations including alert triage, incident coordination, containment, remediation, recovery, and closure.
Cloud & Embedded Investigation and Resolution: Lead investigations of security events across cloud application stacks and embedded vehicle architectures using available logging and telemetry.
People Leadership: Lead, mentor, and develop an established team of analysts, managing shift structure and operational readiness.
Global Coverage Partnership: Partner with the Monitoring Global team to sustain seamless follow-the-sun coverage, consistent standards, and robust cross-region handoff.
Operational Improvement and Feedback Loop: Provide structured feedback to the Monitoring Development team to identify friction points and improve detection logic, tooling, and response workflows.
Cross-Functional Partnership: Collaborate closely with the Cyber Incident Response Team (CIRT), Product Development, and Enterprise IT to execute response playbooks and coordinate complex mitigations.
You'll have...
Bachelor’s degree in Computer Science, Cybersecurity, or Engineering, or related field OR a combination of education and experience.
5+ years in cybersecurity including experience leading SOC, incident response, or security operations teams. • Deep understanding of incident response lifecycles, escalation management, and incident management practices.
Hands-on experience with cloud security operations on one or more major cloud platforms, including logging, monitoring, identity, and response workflows.
Experience investigating and responding to incidents in hybrid environments spanning cloud services, enterprise IT, and connected/embedded systems.
Experience partnering with engineering and infrastructure teams to triage, contain, and remediate production-impacting issues.
Proven ability to manage high-pressure security incidents, mentor technical teams, and communicate clearly with senior leadership.
Even better, you may have...
2+ years of people leadership or program leadership in SOC, cloud operations, or security engineering environments.
Prior experience leading teams in 24x7 operations, including shift handoff, incident prioritization, and operational readiness.
Familiarity with detecting and investigating threats across cloud and vehicle telemetry data, including log correlation and alert tuning.
Technical understanding of embedded or automotive environments and the security considerations of cloud architecture.
Background in building, refining, or operationalizing runbooks, playbooks, and escalation procedures at scale.
Relevant certifications such as CISSP, CISM, GIAC, or cloud security certifications across AWS, Azure, or GCP.
Ability to turn incidents into platform, process, or detection improvements.
You may not check every box, or your experience may look a little different from what we've outlined, but if you think you can bring value to Ford Motor Company, we encourage you to apply!

Nice-to-haves

Master’s degree preferred

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsazuregcp

Platform: eightfold
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

Paid Time Off

Parental Leave