Director, Third-Party Cyber Defense

At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.

Job Description

The Director, Third-Party Cyber Defense is Allstate’s senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look.

The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate’s exposure and a stronger supplier ecosystem after every event.

As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.

A supplier just told us they’ve been breached.

It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:

• Do they have our data? Which data, about which customers, in which states.

• How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.

• What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.

• What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.

• What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don’t call for it.

The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.

Building that capability is the job, and it’s what we’re building at Allstate.

What we’re building

Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:

• A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.

• Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.

• Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.

• Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.

• A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.

• Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.

We need a leader who can bring these together and make them dependable at enterprise scale.

Why this matters

Allstate exists to protect people from life’s uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations…