Manager, Cyber Threat Management

Description

U.S. Citizenship is required for this position due to Department of Defense restrictions.

Our Manager, Cyber Threat Management leads WPS's detection, prevention, and response capabilities and reports directly to the Chief Information Security Officer. This Manager owns cyber incident management, threat detection and prevention, application security leadership, vulnerability management coordination, and security automation and analytics. They align security operations, analyst workflows, and application security activities within the Enterprise Cyber Resilience operating model. This Manager builds and leads the Cyber Threat Management team - our Security Operations Center (SOC) and partners with Cyber Trust & Architecture, Cyber Risk & Assurance, and Cyber Business Enablement to reduce technical risk across the enterprise.

The base pay offered for this position may vary within the posted range based on your job-related knowledge, skills, experience and may fall outside of this range.

Our first consideration will be to have this employee be able to take advantage of Hybrid work and collaboration, living within the state of Wisconsin. Employees within 45 miles of WPS Headquarters (1717 W. Broadway in Madison, WI, 53713) will be expected to be able to work in office 3 days a week on a regular basis.

How do I know this opportunity is right for me? If you:

• Enjoy leading endtoend cyber incident management-including detection, triage, containment, eradication, and recovery. And can serving as incident commander for significant events and continuously mature incident handling playbooks, workflows, and escalation practices.
• Can own enterprise threat detection and security monitoring by managing logging, behavioral analytics, endpoint security tooling, and threat prevention technologies.
• Have advanced security automation and operational analytics, including SOAR and detection engineering, to improve detection and response speed and translate operational security data into actionable metrics.
• Want to ensure visibility across systems, applications, cloud environments, and network activity.
• Can provide leadership and program oversight for Application Security by driving adoption of secure-development standards owned by Cyber Trust & Architecture and oversee developer security training and application-security testing tooling and coordinating remediation with development teams.
• Would enjoy owning enterprise vulnerability management by overseeing scanning, riskbased prioritization, and remediation tracking across system and application owners.
• Have reduced tooling sprawl and eliminate overlapping coverage to streamline the capability.
• Thrive when leading and mentoring Cyber Threat Management teams, establishing clear responsibilities, coverage/on-call models, accountability, career paths, performance expectations, and workforce capacity planning while fostering collaboration and continuous improvement.
• Want to partner with Cyber Trust & Architecture, Cyber Risk & Assurance, and Cyber Business Enablement teams to align detection and response priorities with architecture standards and risk findings and deliver concise reporting and escalation to cybersecurity leadership.
• Can partner with technology and business continuity teams to strengthen cyberrelated impact analysis and recovery capabilities.
• Have ensured response plans and recovery procedures remain current, validated, and tested.
• Want to play a key role in establish Cyber Threat Management operational priorities independently within established playbooks and escalation thresholds; report significant threats, incidents, and risk trends to the CISO, and elevate risk-acceptance decisions beyond established thresholds or requiring architecture changes to the CISO or Cyber Trust & Architecture.

• U.S. Citizenship is required for this position due to Department of Defense restrictions.
• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology OR equivalent combination of education and work experience.
• 7 or more years of progressive experience in cybersecurity operations, incident response, vulnerability management, application security, or a related technical security discipline.
• 3 or more years of people-management experience leading technical security staff.
• Expertise and hands-on experience with security monitoring, detection, and incident-response processes and technologies, such as…