Manager, Threat Defense Services

The following duties are normal for this position. The omission of specific statements of duties does not exclude them from being expected of this position if the work is similar, related, or a logical assignment for this position. Other duties may be required.

• Management of the Threat Defense personnel and promoting their individual growth.
• Interfacing with clients to review environments, solve CSAT issues, & build relationships.
• Partner with Implementations to ensure smooth transition of services from inception to operations.
• Mature and develop the processes, procedures, and services of the Threat Defense.
• Create, maintain, and mature Standard Operating Procedures (SOPs) and training documentation.
• Perform advanced incident investigation.
• Ability to take the lead on incident research when appropriate.
• Exercise multitasking skills by managing multiple projects concurrently.
• Audit analyst investigations and escalations to highlight great work and coaching opportunities to add additional value to clients.
• Create advanced rules based on the latest security threats and events.
• Act as the SME for all technology used in service delivery.
• Present alerts, metrics, and remediation tasks to customers via approved communication plans.
• Communicate effectively and clearly with clients on high-level security concepts and requirements.

• Bachelor's Degree in Computer Science, Management Information Systems, or other relevant combination of training and experience preferred.
• 5+ years of proven work experience in a technical Cybersecurity role.
• 2+ years of management or leadership experience.
• Advanced systems administration experience.
• Healthcare industry experience preferred.

The successful candidate will demonstrate a strong combination of technical cybersecurity expertise, leadership capability, operational judgment, and client-facing communication skills, including:

• Deep knowledge of security operations and threat detection
  , including incident response, alert investigation and triage, escalation management, SIEM operations, log and network traffic analysis, detection engineering, correlation logic, detection and suppression rule management, playbook development, and malware investigation and remediation.
• Broad knowledge of modern security technologies and controls
  , including SIEM, endpoint detection and response (EDR/XDR), firewalls, intrusion detection and prevention, identity and user security, data loss prevention, vulnerability management, cloud security, and other technologies commonly used within enterprise security programs.
• Strong technical aptitude and curiosity
  , with the ability to quickly learn new security platforms and technologies, develop subject matter expertise, troubleshoot complex issues, and guide analysts in developing their own technical proficiency.
• Strong understanding of security architecture and defense-in-depth principles across endpoint, identity, network, cloud, user, and data security, including how telemetry and controls from these environments contribute to effective detection and response.
• Strong understanding of Windows operating systems, security events, logging, and common attack techniques
  , as well as adversary frameworks such as MITRE ATT&CK.
• Strong troubleshooting and root cause analysis skills
  , with the ability to identify patterns, understand complex technical issues, and translate findings into improvements to detections, processes, technologies, and service delivery.
• Working knowledge of scripting and automation
  , including technologies such as Python, Power Shell, and Bash, and an understanding of how automation can improve the scalability, consistency, and effectiveness of SOC operations.
• S…