Director, Third-Party Cyber Defense

At Allstate, great things happen when our people work together to protect families and their belongings from life's uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers' evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.

Job Description

A supplier just told us they've been breached.

It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:

• Do they have our data? Which data, about which customers, in which states.

• How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.

• What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.

• What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.

• What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don't call for it.

The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.

Building that capability is the job, and it's what we're building at Allstate.

Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:

• A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.

• Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.

• Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.

• Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.

• A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.

• Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.

We need a leader who can bring these together and make them dependable at enterprise scale.

Allstate exists to protect people from life's uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it.

• A new function to build. You'll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team.

• Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers.

• Strong partners from day one. You'll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company.

• Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows.
  

• Build the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature.

• Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines.

• Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM's tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement.

• Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked.

• Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on.

• Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure each critical connection has a documented and tested cut-off procedure.

• Hear about trouble early. Lead continuous monitoring of critical suppliers and work with Threat Intelligence so supplier breach news reaches the team quickly. Extend that view to fourth parties and concentration risk.

• Draw clean lines with partners. Agree on who owns what with Enterprise TPRM and Procurement, Security Operations, Threat Intelligence, Exposure Management, and Legal & Privacy. This is a cyber function, not a second TPRM program.

• Measure progress. Report on time from supplier signal to triage, time to confirm our exposure, targeted technical assessments completed and handed to TPRM, and the percentage of critical connections with a tested cut-off, for leadership, the board, and regulators.

• Build and develop the team. Hire the leads for both teams, bring incident response, intelligence, and technical assessment skills together, and develop people who can move between them.
  

• 12+ years in cybersecurity across incident response, third-party cyber risk, or security operations, including 5+ years leading teams.

• Hands-on incident response experience, including incidents at suppliers or service providers where you had to get timely, accurate facts from an organization you do not control.

• Hands-on experience performing or leading technical security assessments of suppliers, and working knowledge of the third-party risk management lifecycle.

• Working knowledge of assessment frameworks and evidence, such as SOC 2, ISO 27001, SIG, and NIST CSF 2.0, and of continuous monitoring platforms.

• A technical understanding of how suppliers connect to a large enterprise: SaaS integrations, API and service accounts, B2B network links, managed file transfer, and managed service provider access.

• Experience in a regulated industry such as insurance, financial services, or healthcare, including working knowledge of obligations like NYDFS Part 500.

• A record of building a new function and scaling it into a repeatable, measurable program.

• Sound judgment under pressure and clear communication: telling Legal and business leaders what we know, what we don't, and what we recommend, and holding suppliers to what they owe us.

Skills

Compensation

The candidate(s) offered this position will be required to submit to a background investigation.

Joining our team isn't just a job - it's an opportunity. One that takes your skills and pushes them to the next level. One that encourages you to challenge the status quo. One where you can shape the future of protection while supporting causes that mean the most to you. Joining our team means being part of something bigger - a winning team making a meaningful impact.

Allstate generally does not sponsor individuals for employment-based visas for this position.

Effective July 1, 2014, under Indiana House Enrolled Act (HEA) 1242, it is against public policy of the State of Indiana and a discriminatory practice for an employer to discriminate against a prospective employee on the basis of status as a veteran by refusing to employ an applicant on the basis that they are a veteran of the armed forces of the United States, a member of the Indiana National Guard or a member of a reserve component.

For jobs in San Francisco, please click "here" for information regarding the San Francisco Fair Chance Ordinance.

For jobs in Los Angeles, please click "here" for information regarding the Los Angeles Fair Chance Initiative for Hiring Ordinance.

To view the "EEO Know Your Rights" poster click "here". This poster provides information concerning the laws and procedures for filing complaints of violations of the laws with the Office of Federal Contract Compliance Programs.

To view the FMLA poster, click "here". This poster summarizing the major provisions of the Family and Medical Leave Act (FMLA) and telling employees how to file a complaint.

It is the Company's policy to employ the best qualified individuals available for all jobs. Therefore, any discriminatory action taken on account of an employee's ancestry, age, color, disability, genetic information, gender, gender identity, gender expression, sexual and reproductive health decision, marital status, medical condition, military or veteran status, national origin, race (include traits historically associated with race, including, but not limited to, hair texture and protective hairstyles), religion (including religious dress), sex, or sexual orientation that adversely affects an employee's terms or conditions of employment is prohibited. This policy applies to all aspects of the employment relationship, including, but not limited to, hiring, training, salary administration, promotion, job assignment, benefits, discipline, and separation of employment.

Allstate provides a comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home also receive a monthly connectivity reimbursement to help offset internet costs.

When working from home, you must have a dedicated, private workspace free from distractions, along with appropriate desk and seating. Reliable internet is required, with minimum speeds of 50 MB download and 5 MB upload.

To help create a more personal and engaging experience, we ask that you join with your camera on if your interview is virtual. Please also have a Valid Photo Identification available at the start of your interview. If you require any accommodations or have questions ahead of your interview please reach out to your recruiter.

Note: Internal candidates are only asked to join on video; a Valid Photo Identification is not needed for the interview.