Information Technology Security Manager

Role: Manager, IT Security Engineering & Operations

Core

Purpose:

Lead and execute the organization’s security engineering and security operations functions.

Scope: Own the design, implementation, and operation of security controls across cloud, applications, endpoints, identity, and network environments.

Nature of Role: Hands‑on leadership role combining technical execution with team management, requiring active contribution to engineering and operational activities while leading a small team.

Reporting Structure: Reports to the VP of Information Security & GRC.

Collaboration: Works closely with Security & Compliance, IT Infrastructure & Operations, and Application teams.

• Lead the design and implementation of security controls across enterprise cloud, productivity, and SaaS platforms.
• Drive security hardening initiatives across cloud and enterprise platforms, including baseline configurations.
• Define and enforce secure architecture standards in partnership with Infrastructure and Application Development teams.

• Manage security operations, including monitoring, detection, and incident response.
• Manage and optimize Security Operations Center (SOC) / Managed Detection and Response (MDR) services and vendor performance.
• Improve detection quality, reduce false positives, and strengthen response capabilities.
• Lead incident response efforts and conduct post‑incident reviews.
• Manage cloud security posture across all enterprise cloud and SaaS environments.
• Lead application security initiatives, including code scanning, API security, and secure development practices.
• Manage and optimize Web Application Firewall (WAF) capabilities.
• Integrate security into CI/CD pipelines and development workflows.

• Manage the vulnerability management program end‑to‑end.
• Ensure vulnerabilities are remediated within defined SLAs.
• Drive accountability across IT and application teams for remediation efforts.
• Deliver clear reporting and metrics regarding vulnerability status to leadership.

• Manage and optimize core security technologies, including:
• Endpoint protection platforms
• Identity security, conditional access, and privileged identity management
• Enterprise productivity suite security
• WAF and edge protection
• SIEM/SOAR and MDR integrations
• Ensure all security tools are properly configured, maintained, and delivering measurable value.

• Partner with Security & GRC to support PCI DSS and SOX ITGC compliance requirements.
• Ensure required security controls are implemented and operating effectively.
• Support external and internal audits, remediation tracking, and control validation.
• Directly manage, mentor, and develop a small team of security engineering and administrative professionals.
• Set clear priorities, goals, and expectations for the team.
• Drive accountability and execution across the team while remaining actively involved in technical delivery.

• 7+ years of experience in security engineering or security operations.
• Proven experience leading teams while remaining hands‑on in technical work.
• Strong experience with enterprise cloud and productivity suites.
• Experience managing external SOC/MDR vendors and services.
• Hands‑on experience with vulnerability management and incident response execution.
• Experience with application security and WAF technologies.
• Strong technical knowledge in threat detection, cloud security architecture, identity and access management, and endpoint/email security.
• Solid understanding of PCI DSS, SOX ITGC, and NIST CSF frameworks.

• Bachelor’s degree in Computer Science, Information Technology, a related field, or equivalent professional experience.
• Preferred
  
  Certifications:
• Certified Information Systems Security Professional (CISSP)
• Cloud Security certifications (e.g., CCSP or equivalent)
• Security operations or incident response certifications (e.g., GCIH or equivalent)