Director, Third-Party Cyber Defense

Job description

At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection. Job Description The Director, Third-Party Cyber Defense is Allstate’s senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look. The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate’s exposure and a stronger supplier ecosystem after every event. As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities. A supplier just told us they’ve been breached. It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well: Do they have our data? Which data, about which customers, in which states. How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely. What did we already know about them? Their risk tier, their last assessment, and the findings that are still open. What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them. What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don’t call for it. The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came. Building that capability is the job, and it’s what we’re building at Allstate. What we’re buildingAllstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability: A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command. Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM. Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate. Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early. A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to. Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management. We need a leader who can bring these together and make them dependable at enterprise scale. Why this mattersAllstate exists to protect people from life’s uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it. What Allstate can do for youA new function to build. You’ll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team. Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers. Strong partners from day one. You’ll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company. Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows. What you can do for AllstateBuild the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature. Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines. Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM’s tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement. Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked. Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on. Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure e