Allstate
Director, Third-Party Cyber Defense
Key aspects of the role:
- Drive sales growth by engaging with interested prospective customers- all while working remote
- No cold calling— Connect through inbound calls and proactive outbound calls with active insurance shoppers
- Enjoy competitive compensation with a base salary + uncapped performance-based incentives
- Sell reputable products from Allstate and our family of brands
Role overview
At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.
Job Description
The Director, Third-Party Cyber Defense is Allstate’s senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look.
The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate’s exposure and a stronger supplier ecosystem after every event.
As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.
A supplier just told us they’ve been breached.
It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:
- Do they have our data? Which data, about which customers, in which states.
- How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.
- What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.
- What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.
- What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don’t call for it.
The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.
Building that capability is the job, and it’s what we’re building at Allstate.
What we’re building
Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:
- A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.
- Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.
- Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.
- Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.
- A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.
- Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.
We need a leader who can bring these together and make them dependable at enterprise scale.
Why this matters
Allstate exists to protect people from life’s uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it.
What Allstate can do for you
- A new function to build. You’ll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team.
- Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers.
- Strong partners from day one. You’ll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company.
- Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows.
What you can do for Allstate
- Build the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature.
- Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines.
- Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM’s tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement.
- Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked.
- Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on.
- Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure each critical connection has a documented and tested cut-off procedure.
- Hear about trouble early. Lead continuous monitoring of critical suppliers and work with Threat Intelligence so supplier breach news reaches the team quickly. Extend that view to fourth parties and concentration risk.
- Draw clean lines with partners. Agree on who owns what with Enterprise TPRM and Procurement, Security Operations, Threat Intelligence, Exposure Management, and Legal & Privacy. This is a cyber function, not a second TPRM program.
- Measure progress. Report on time from supplier signal to triage, time to confirm our exposure, targeted technical assessments completed and handed to TPRM, and the percentage of critical connections with a tested cut-off, for leadership, the board, and regulators.
- Build and develop the team. Hire the leads for both teams, bring incident response, intelligence, and technical assessment skills together, and develop people who can move between them.
What you should bring with you
- 12+ years in cybersecurity across incident response, third-party cyber risk, or security operations, including 5+ years leading teams.
- Hands-on incident response experience, including incidents at suppliers or service providers where you had to get timely, accurate facts from an organization you do not control.
- Hands-on experience performing or leading technical security assessments of suppliers, and working knowledge of the third-party risk management lifecycle.
- Working knowledge of assessment frameworks and evidence, such as SOC 2, ISO 27001, SIG, and NIST CSF 2.0, and of continuous monitoring platforms.
- A technical understanding of how suppliers connect to a large enterprise: SaaS integrations, API and service accounts, B2B network links, managed file transfer, and managed service provider access.
- Experience in a regulated industry such as insurance, financial services, or healthcare, including working knowledge of obligations like NYDFS Part 500.
- A record of building a new function and scaling it into a repeatable, measurable program.
- Sound judgment under pressure and clear communication: telling Legal and business leaders what we know, what we don’t, and what we recommend, and holding suppliers to what they owe us.
Skills
Cyber Incident Response, Data Connectivity, Executive Influence, Incident Response, People Leadership, Security Evaluations, Security Operations, Supply Chain Assessment, Technical Security
Compensation
Compensation offered for this role is 187,500.00 – 258,375.00 annually and is based on experience and qualifications.
The candidate(s) offered this position will be required to submit to a background investigation.
Joining our team isn’t just a job — it’s an opportunity. One that takes your skills and pushes them to the next level. One that encourages you to challenge the status quo. One where you can shape the future of protection while supporting causes that mean the most to you. Joining our team means being part of something bigger – a winning team making a meaningful impact.
Allstate generally does not sponsor individuals for employment-based visas for this position.
Effective July 1, 2014, under Indiana House Enrolled Act (HEA) 1242, it is against public policy of the State of Indiana and a discriminatory practice for an employer to discriminate against a prospective employee on the basis of status as a veteran by refusing to employ an applicant on the basis that they are a veteran of the armed forces of the United States, a member of the Indiana National Guard or a member of a reserve component.
For jobs in San Francisco, please click “here” for information regarding the San Francisco Fair Chance Ordinance.
For jobs in Los Angeles, please click “here” for information regarding the Los Angeles Fair Chance Initiative for Hiring Ordinance.
To view the “EEO Know Your Rights” poster click “here”. This poster provides information concerning the laws and procedures for filing complaints of violations of the laws with the Office of Federal Contract Compliance Programs.
To view the FMLA poster, click “here”. This poster summarizing the major provisions of the Family and Medical Leave Act (FMLA) and telling employees how to file a complaint.
It is the Company’s policy to employ the best qualified individuals available for all jobs. Therefore, any discriminatory action taken on account of an employee’s ancestry, age, color, disability, genetic information, gender, gender identity, gender expression, sexual and reproductive health decision, marital status, medical condition, military or veteran status, national origin, race (include traits historically associated with race, including, but not limited to, hair texture and protective hairstyles), religion (including religious dress), sex, or sexual orientation that adversely affects an employee's terms or conditions of employment is prohibited. This policy applies to all aspects of the employment relationship, including, but not limited to, hiring, training, salary administration, promotion, job assignment, benefits, discipline, and separation of employment.
Allstate provides a comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home also receive a monthly connectivity reimbursement to help offset internet costs.
When working from home, you must have a dedicated, private workspace free from distractions, along with appropriate desk and seating. Reliable internet is required, with minimum speeds of 50 MB download and 5 MB upload.
To help create a more personal and engaging experience, we ask that you join with your camera on if your interview is virtual. Please also have a Valid Photo Identification available at the start of your interview. If you require any accommodations or have questions ahead of your interview please reach out to your recruiter.
Note: Internal candidates are only asked to join on video; a Valid Photo Identification is not needed for the interview.
Keys to Success
At Allstate, it’s all about teamwork, flexibility, and thinking ahead. We all contribute to the bigger picture, combining unique ideas to design innovative, more affordable protection solutions for customers.
We look for candidates with these skills to help us achieve that goal:
Learning agility
Quickly adapt to new situations, continually build new skills, experiment, and embrace new ways of doing things
Customer centricity
Deliver exceptional experience with a customer-first mindset and human-centered design
Digital literacy
Discover and apply emerging digital technology tools, data and insights.
Results-oriented
Start with measurable outcomes and drive results with speed
Inclusive leadership
Integrate diverse viewpoints into decision-making processes to enhance creativity and innovation
Together, we’re all working toward Our Shared Purpose, using our strengths to make a real difference for our people, our customers, our company, and the world around us.
Working in Sales
What We Do:
As an expert on our products and services, you can give customers personalized attention and innovative solutions to make their lives easier.
How We Support You:
Starting day one, you’ll have access to resources and incentives to keep you feeling challenged and excited about your careers.
Make An Impact:
As a member of our sales team, you’ll bring a sense of ease and support to customers looking for a better understanding of their protection options. Whether in the field or talking to customers over the phone, you’ll continue to build trust in who we are and what we do.
Working together
You’re in Good Hands® is more than a promise we make to our customers. It’s a promise we make to our employees, too.
We want you to love where you work. That starts with the freedom to be yourself. Our workplace flexibility and focus on individuality means everyone is seen, heard and respected.
When you join us, you’ll have the opportunity to push your skills to the next level with access to development programs to support your career aspirations – whatever that means for you. Because as you learn and grow, so do we.
Working here also means getting the chance to make a real impact in your community. We have been driving change for over 90 years, but the mark we leave on the world can be even greater when we work together.
Role overview
At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.
Job Description
The Director, Third-Party Cyber Defense is Allstate’s senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look.
The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate’s exposure and a stronger supplier ecosystem after every event.
As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.
A supplier just told us they’ve been breached.
It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:
- Do they have our data? Which data, about which customers, in which states.
- How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.
- What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.
- What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.
- What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don’t call for it.
The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.
Building that capability is the job, and it’s what we’re building at Allstate.
What we’re building
Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:
- A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.
- Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.
- Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.
- Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.
- A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.
- Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.
We need a leader who can bring these together and make them dependable at enterprise scale.
Why this matters
Allstate exists to protect people from life’s uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it.
What Allstate can do for you
- A new function to build. You’ll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team.
- Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers.
- Strong partners from day one. You’ll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company.
- Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows.
What you can do for Allstate
- Build the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature.
- Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines.
- Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM’s tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement.
- Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked.
- Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on.
- Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure each critical connection has a documented and tested cut-off procedure.
- Hear about trouble early. Lead continuous monitoring of critical suppliers and work with Threat Intelligence so supplier breach news reaches the team quickly. Extend that view to fourth parties and concentration risk.
- Draw clean lines with partners. Agree on who owns what with Enterprise TPRM and Procurement, Security Operations, Threat Intelligence, Exposure Management, and Legal & Privacy. This is a cyber function, not a second TPRM program.
- Measure progress. Report on time from supplier signal to triage, time to confirm our exposure, targeted technical assessments completed and handed to TPRM, and the percentage of critical connections with a tested cut-off, for leadership, the board, and regulators.
- Build and develop the team. Hire the leads for both teams, bring incident response, intelligence, and technical assessment skills together, and develop people who can move between them.
What you should bring with you
- 12+ years in cybersecurity across incident response, third-party cyber risk, or security operations, including 5+ years leading teams.
- Hands-on incident response experience, including incidents at suppliers or service providers where you had to get timely, accurate facts from an organization you do not control.
- Hands-on experience performing or leading technical security assessments of suppliers, and working knowledge of the third-party risk management lifecycle.
- Working knowledge of assessment frameworks and evidence, such as SOC 2, ISO 27001, SIG, and NIST CSF 2.0, and of continuous monitoring platforms.
- A technical understanding of how suppliers connect to a large enterprise: SaaS integrations, API and service accounts, B2B network links, managed file transfer, and managed service provider access.
- Experience in a regulated industry such as insurance, financial services, or healthcare, including working knowledge of obligations like NYDFS Part 500.
- A record of building a new function and scaling it into a repeatable, measurable program.
- Sound judgment under pressure and clear communication: telling Legal and business leaders what we know, what we don’t, and what we recommend, and holding suppliers to what they owe us.
Skills
Cyber Incident Response, Data Connectivity, Executive Influence, Incident Response, People Leadership, Security Evaluations, Security Operations, Supply Chain Assessment, Technical Security
Compensation
Compensation offered for this role is 187,500.00 – 258,375.00 annually and is based on experience and qualifications.
The candidate(s) offered this position will be required to submit to a background investigation.
Joining our team isn’t just a job — it’s an opportunity. One that takes your skills and pushes them to the next level. One that encourages you to challenge the status quo. One where you can shape the future of protection while supporting causes that mean the most to you. Joining our team means being part of something bigger – a winning team making a meaningful impact.
Allstate generally does not sponsor individuals for employment-based visas for this position.
Effective July 1, 2014, under Indiana House Enrolled Act (HEA) 1242, it is against public policy of the State of Indiana and a discriminatory practice for an employer to discriminate against a prospective employee on the basis of status as a veteran by refusing to employ an applicant on the basis that they are a veteran of the armed forces of the United States, a member of the Indiana National Guard or a member of a reserve component.
For jobs in San Francisco, please click “here” for information regarding the San Francisco Fair Chance Ordinance.
For jobs in Los Angeles, please click “here” for information regarding the Los Angeles Fair Chance Initiative for Hiring Ordinance.
To view the “EEO Know Your Rights” poster click “here”. This poster provides information concerning the laws and procedures for filing complaints of violations of the laws with the Office of Federal Contract Compliance Programs.
To view the FMLA poster, click “here”. This poster summarizing the major provisions of the Family and Medical Leave Act (FMLA) and telling employees how to file a complaint.
It is the Company’s policy to employ the best qualified individuals available for all jobs. Therefore, any discriminatory action taken on account of an employee’s ancestry, age, color, disability, genetic information, gender, gender identity, gender expression, sexual and reproductive health decision, marital status, medical condition, military or veteran status, national origin, race (include traits historically associated with race, including, but not limited to, hair texture and protective hairstyles), religion (including religious dress), sex, or sexual orientation that adversely affects an employee's terms or conditions of employment is prohibited. This policy applies to all aspects of the employment relationship, including, but not limited to, hiring, training, salary administration, promotion, job assignment, benefits, discipline, and separation of employment.
Allstate provides a comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home also receive a monthly connectivity reimbursement to help offset internet costs.
When working from home, you must have a dedicated, private workspace free from distractions, along with appropriate desk and seating. Reliable internet is required, with minimum speeds of 50 MB download and 5 MB upload.
To help create a more personal and engaging experience, we ask that you join with your camera on if your interview is virtual. Please also have a Valid Photo Identification available at the start of your interview. If you require any accommodations or have questions ahead of your interview please reach out to your recruiter.
Note: Internal candidates are only asked to join on video; a Valid Photo Identification is not needed for the interview.
Keys to Success
At Allstate, it’s all about teamwork, flexibility, and thinking ahead. We all contribute to the bigger picture, combining unique ideas to design innovative, more affordable protection solutions for customers.
We look for candidates with these skills to help us achieve that goal:
Learning agility
Quickly adapt to new situations, continually build new skills, experiment, and embrace new ways of doing things
Customer centricity
Deliver exceptional experience with a customer-first mindset and human-centered design
Digital literacy
Discover and apply emerging digital technology tools, data and insights.
Results-oriented
Start with measurable outcomes and drive results with speed
Inclusive leadership
Integrate diverse viewpoints into decision-making processes to enhance creativity and innovation
Together, we’re all working toward Our Shared Purpose, using our strengths to make a real difference for our people, our customers, our company, and the world around us.
Working in Claims
What We Do:
Your ability to quickly and calmly make smart decisions can make a huge difference in how confident customers feel throughout the claims process. And as you support our customers, we’re there to support you.
How We Support You:
We empower your success starting day one. You’ll have access to everything you need to grow professionally while helping our customers get their lives back on track.
Make An Impact:
Helping customers with their claims is about learning their stories, not just processing their paperwork. You can take pride in the fact that you’re providing invaluable guidance and helping to build continued trust in our company.
Working together
You’re in Good Hands® is more than a promise we make to our customers. It’s a promise we make to our employees, too.
We want you to love where you work. That starts with the freedom to be yourself. Our workplace flexibility and focus on individuality means everyone is seen, heard and respected.
When you join us, you’ll have the opportunity to push your skills to the next level with access to development programs to support your career aspirations – whatever that means for you. Because as you learn and grow, so do we.
Working here also means getting the chance to make a real impact in your community. We have been driving change for over 90 years, but the mark we leave on the world can be even greater when we work together.
Role overview
At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.
Job Description
The Director, Third-Party Cyber Defense is Allstate’s senior leader for supplier cyber incident response. The role is accountable for how quickly and appropriately Allstate understands and responds when a supplier is compromised. This leader sets direction for two functions: Supplier Incident Investigation & Response, and Supplier Monitoring & Intelligence. The Director also owns the technical inventory of supplier connections and leads targeted technical assessments when incidents, intelligence, or monitoring signals call for a closer look.
The role calls for an experienced incident response leader who understands how suppliers connect to large enterprises and can build a team that performs consistently under pressure. As a member of the Cyber Defense & Response leadership team, the Director partners with Enterprise TPRM, Procurement, Legal & Privacy, and Security Operations. Together they deliver fast, fact-based answers about Allstate’s exposure and a stronger supplier ecosystem after every event.
As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.
A supplier just told us they’ve been breached.
It is now one of the most common ways a cyber incident reaches a large company: a claims vendor, a payroll provider, a SaaS platform, a file-transfer service. The notice is usually short and vague. From that moment, five questions decide whether Allstate handles it well:
- Do they have our data? Which data, about which customers, in which states.
- How do they reach us? Every network link, API, file transfer, and service account, and whether we can shut each one down safely.
- What did we already know about them? Their risk tier, their last assessment, and the findings that are still open.
- What do they owe us? The notification, cooperation, and audit terms in their contract, and whether they are living up to them.
- What is the right response? Action that fits the facts: enough to protect our customers, without shutting down a business process when the facts don’t call for it.
The best third-party programs answer all five within hours, every time. Not because someone heroic stays up all night, but because the assessments were done, the connections were mapped, the playbook was practiced, and the working relationships with Legal, Privacy, Procurement, and Security Operations were in place before the call came.
Building that capability is the job, and it’s what we’re building at Allstate.
What we’re building
Allstate is establishing Third-Party Cyber Defense as a dedicated pillar within Cyber Defense & Response, bringing supplier incident response, supplier monitoring and intelligence, and targeted technical assessment together into one mature, repeatable capability:
- A supplier incident response practice. A dedicated team with clear intake, triage, and severity criteria, a standard way of engaging suppliers, playbooks for the most common supplier incidents, and agreed escalation into enterprise incident command.
- Targeted supplier technical assessment. Deep technical reviews of specific suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one, with findings handed to TPRM to record and govern. Onboarding, tiering, and scheduled reassessment remain with TPRM.
- Shared supplier context. Response and monitoring built on the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, so every incident starts with a clear view of who the supplier is to Allstate.
- Ongoing visibility into our suppliers. Security ratings, attack-surface signals, and supplier breach intelligence from Threat Intelligence, so we hear about trouble early.
- A clear picture of how suppliers connect to us. A technical inventory of supplier connections and accounts, security review and recertification, and a tested way to cut off each critical connection if we ever need to.
- Strong partnerships. Clear hand-offs with Enterprise TPRM and Procurement, Legal & Privacy, Security Operations, Threat Intelligence, and Exposure Management.
We need a leader who can bring these together and make them dependable at enterprise scale.
Why this matters
Allstate exists to protect people from life’s uncertainties, and a growing share of the data and services that let us do that sit with our suppliers. Attackers know it: the 2026 Verizon Data Breach Investigations Report found a third party involved in nearly half of all breaches, up sharply from the year before. Regulators have been clear that insurers remain accountable for the providers they rely on. When a supplier has an incident, what matters is how quickly we understand what it means for Allstate and whether our response fits the facts. Overreacting disrupts the business; underreacting puts customers at risk. Getting it right every time takes preparation, practice, and a team built for it.
What Allstate can do for you
- A new function to build. You’ll lead two teams, Supplier Incident Investigation & Response and Supplier Monitoring & Intelligence, and shape how they work together, including how targeted technical assessment is delivered. A dedicated assessment team is a planned decision as demand is demonstrated. You report to the leader of Cyber Defense & Response and sit on that leadership team.
- Scale and stakes. A Fortune 100 insurer with a large, varied supplier ecosystem spanning claims, agency, cloud, SaaS, and data providers.
- Strong partners from day one. You’ll work alongside Security Operations, Threat Intelligence, Exposure Management, and Red Team within Cyber Defense & Response, and with Enterprise TPRM, Procurement, and Legal & Privacy across the company.
- Support for doing it right. Leadership backing and a clear mandate to build a lasting capability, with room to shape how it grows.
What you can do for Allstate
- Build the supplier incident response muscle. Define intake, triage, severity criteria, a standard supplier question set, and playbooks for the most common scenarios. Run tabletop exercises with Security Operations, Legal, Privacy, and business owners until the process is second nature.
- Respond quickly and in proportion. When a supplier is hit, establish the facts, determine the impact on Allstate data, systems, customers, and access, and choose actions that fit those facts. Deliver an impact summary that lets Legal & Privacy make notification decisions within regulatory timelines.
- Assess where it matters most. Lead targeted technical assessments of suppliers when an incident, threat intelligence, a monitoring signal, or a TPRM referral calls for one. Use TPRM’s tiering to prioritize monitoring and response, contribute cyber input to how suppliers are tiered, and provide incident-response and technical-security requirements to TPRM, Legal, and Procurement.
- Hand off findings cleanly. Own operational incident actions through to completion. TPRM records and governs enduring supplier-risk findings, and the team confirms technical closure of incident-related findings when asked.
- Build on enterprise supplier data. Work from the enterprise supplier inventory, the TPRM system of record, contract data, and business-service mapping, and partner with TPRM on the access and integration that response and monitoring depend on.
- Know how suppliers connect to us. Own the technical inventory of supplier connections and accounts, working with Identity & Access Management, and make sure each critical connection has a documented and tested cut-off procedure.
- Hear about trouble early. Lead continuous monitoring of critical suppliers and work with Threat Intelligence so supplier breach news reaches the team quickly. Extend that view to fourth parties and concentration risk.
- Draw clean lines with partners. Agree on who owns what with Enterprise TPRM and Procurement, Security Operations, Threat Intelligence, Exposure Management, and Legal & Privacy. This is a cyber function, not a second TPRM program.
- Measure progress. Report on time from supplier signal to triage, time to confirm our exposure, targeted technical assessments completed and handed to TPRM, and the percentage of critical connections with a tested cut-off, for leadership, the board, and regulators.
- Build and develop the team. Hire the leads for both teams, bring incident response, intelligence, and technical assessment skills together, and develop people who can move between them.
What you should bring with you
- 12+ years in cybersecurity across incident response, third-party cyber risk, or security operations, including 5+ years leading teams.
- Hands-on incident response experience, including incidents at suppliers or service providers where you had to get timely, accurate facts from an organization you do not control.
- Hands-on experience performing or leading technical security assessments of suppliers, and working knowledge of the third-party risk management lifecycle.
- Working knowledge of assessment frameworks and evidence, such as SOC 2, ISO 27001, SIG, and NIST CSF 2.0, and of continuous monitoring platforms.
- A technical understanding of how suppliers connect to a large enterprise: SaaS integrations, API and service accounts, B2B network links, managed file transfer, and managed service provider access.
- Experience in a regulated industry such as insurance, financial services, or healthcare, including working knowledge of obligations like NYDFS Part 500.
- A record of building a new function and scaling it into a repeatable, measurable program.
- Sound judgment under pressure and clear communication: telling Legal and business leaders what we know, what we don’t, and what we recommend, and holding suppliers to what they owe us.
Skills
Cyber Incident Response, Data Connectivity, Executive Influence, Incident Response, People Leadership, Security Evaluations, Security Operations, Supply Chain Assessment, Technical Security
Compensation
Compensation offered for this role is 187,500.00 – 258,375.00 annually and is based on experience and qualifications.
The candidate(s) offered this position will be required to submit to a background investigation.
Joining our team isn’t just a job — it’s an opportunity. One that takes your skills and pushes them to the next level. One that encourages you to challenge the status quo. One where you can shape the future of protection while supporting causes that mean the most to you. Joining our team means being part of something bigger – a winning team making a meaningful impact.
Allstate generally does not sponsor individuals for employment-based visas for this position.
Effective July 1, 2014, under Indiana House Enrolled Act (HEA) 1242, it is against public policy of the State of Indiana and a discriminatory practice for an employer to discriminate against a prospective employee on the basis of status as a veteran by refusing to employ an applicant on the basis that they are a veteran of the armed forces of the United States, a member of the Indiana National Guard or a member of a reserve component.
For jobs in San Francisco, please click “here” for information regarding the San Francisco Fair Chance Ordinance.
For jobs in Los Angeles, please click “here” for information regarding the Los Angeles Fair Chance Initiative for Hiring Ordinance.
To view the “EEO Know Your Rights” poster click “here”. This poster provides information concerning the laws and procedures for filing complaints of violations of the laws with the Office of Federal Contract Compliance Programs.
To view the FMLA poster, click “here”. This poster summarizing the major provisions of the Family and Medical Leave Act (FMLA) and telling employees how to file a complaint.
It is the Company’s policy to employ the best qualified individuals available for all jobs. Therefore, any discriminatory action taken on account of an employee’s ancestry, age, color, disability, genetic information, gender, gender identity, gender expression, sexual and reproductive health decision, marital status, medical condition, military or veteran status, national origin, race (include traits historically associated with race, including, but not limited to, hair texture and protective hairstyles), religion (including religious dress), sex, or sexual orientation that adversely affects an employee's terms or conditions of employment is prohibited. This policy applies to all aspects of the employment relationship, including, but not limited to, hiring, training, salary administration, promotion, job assignment, benefits, discipline, and separation of employment.
Allstate provides a comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home also receive a monthly connectivity reimbursement to help offset internet costs.
When working from home, you must have a dedicated, private workspace free from distractions, along with appropriate desk and seating. Reliable internet is required, with minimum speeds of 50 MB download and 5 MB upload.
To help create a more personal and engaging experience, we ask that you join with your camera on if your interview is virtual. Please also have a Valid Photo Identification available at the start of your interview. If you require any accommodations or have questions ahead of your interview please reach out to your recruiter.
Note: Internal candidates are only asked to join on video; a Valid Photo Identification is not needed for the interview.
Keys to Success
At Allstate, it’s all about teamwork, flexibility, and thinking ahead. We all contribute to the bigger picture, combining unique ideas to design innovative, more affordable protection solutions for customers.
We look for candidates with these skills to help us achieve that goal:
Learning agility
Quickly adapt to new situations, continually build new skills, experiment, and embrace new ways of doing things
Customer centricity
Deliver exceptional experience with a customer-first mindset and human-centered design
Digital literacy
Discover and apply emerging digital technology tools, data and insights.
Results-oriented
Start with measurable outcomes and drive results with speed
Inclusive leadership
Integrate diverse viewpoints into decision-making processes to enhance creativity and innovation
Together, we’re all working toward Our Shared Purpose, using our strengths to make a real difference for our people, our customers, our company, and the world around us.
Working together
You’re in Good Hands® is more than a promise we make to our customers. It’s a promise we make to our employees, too.
We want you to love where you work. That starts with the freedom to be yourself. Our workplace flexibility and focus on individuality means everyone is seen, heard and respected.
When you join us, you’ll have the opportunity to push your skills to the next level with access to development programs to support your career aspirations – whatever that means for you. Because as you learn and grow, so do we.
Working here also means getting the chance to make a real impact in your community. We have been driving change for over 90 years, but the mark we leave on the world can be even greater when we work together.
Benefits
Experience the benefits that make Allstate a great place to work.
*Benefits vary based on position.
Health
- Medical, dental and vision coverage
- HSAs and FSAs
- Wellbeing programs
- Free therapy sessions
Retirement
- 401(k) plan
- Pension plan
- Free financial counseling
Work-life balance
- Paid time off
- Work flexibility
Career development
- Talent shares
- Tuition reimbursement
- Learning opportunities
For a full description of Allstate’s benefits visit our benefits page
Start making a difference
Realize your full potential by doing
work that matters.
Grow your career in meaningful ways.
We want to make sure you have every opportunity to grow, explore new horizons and follow your passion in a meaningful career. It’s an exciting time to join Allstate. Help us shape the future.
Ryan / 8 years with Allstate
Business Architect Lead Consultant
June 2025 – Present
Anthony / 11 years with Allstate
New Agent Leader- EA Channel
February 2026 – Present
Michael / 25 years with Allstate
Property Delivery Director
2023 – Present/Remote
Bree / 11 years with Allstate
Unrepresented Bodily Injury Adjuster
December 2022 – Present
Similar opportunities
Can’t find what you’re looking for?
Eric G.
Associate counsel, Innovation Law
Our leaders understand that the world is changing fast and people need to adapt and learn new skills. Allstate is committed to helping employees continuously develop and grow.
Kelly
Cloud Engineer
Dana T.
Senior Product Consultant
Paul D.
Software Engineer
I’m proud of building Allstate’s first Bilingual Unlicensed Service team during my first assignment as a leader. It’s an exciting opportunity for our employees and to better serve our Spanish-speaking customers.
Xiomara
Employee Engagement Leader
Joe W.
Commercial Senior Claims Service Adjuster
Brooke T
Property Senior Claims Adjuster
Everyone is encouraged to volunteer and give back however they can throughout the year. I enjoy giving back to the community and supporting the causes that are meaningful to me.
Lisa
Senior Lead Internal Auditor
