Cyber Security Operations Lead

General information

# 22567

Remote? No

Ally Financial only succeeds when its people do - and that’s more than some cliché people put on job postings. We live this stuff! We see our people as, well, people - with interests, families, friends, dreams, and causes that are all important to them. Our focus is on the health and safety of our teammates as well as work-life balance and diversity and inclusion.

From generous benefits to a variety of employee resource groups, we strive to build paths that encourage employees to stretch themselves professionally. We want to help you grow, develop, and learn new things. You’re constantly evolving, so shouldn’t your opportunities be, too?

The Cyber Security Operations Lead, within Information Protection & Risk Management (IPRM) Data Protection team, is responsible for coordinating the day-to-day operations and strategic direction of the organization's cyber security functions, with a primary focus on key and certificate management, Data Loss Prevention (DLP), and Insider Threat Operations. This role requires a highly motivated individual with deep technical knowledge and expertise, strong leadership skills, and a passion for protecting sensitive information and critical infrastructure.

• Develop and maintain procedures for secure key and certificate lifecycle management, consistently following industry standards and regulatory requirements.
• Guide a dispersed group of cyber security professionals in key and certificate management.
• Complete the operational backlog, ensuring delivery aligns with business and risk priorities.
• Prioritize and sequence work in partnership with Product and Engineering, ensuring alignment with squad objectives.
• Facilitate coordination across Operations, Engineering and Product roles for flawless execution.
• Recognize and handle issues, risks, and dependencies to avoid delivery delays.
• Maintain access to delivery progress, SLA adherence, and overall operational health metrics.
• Collaborate with IT, risk and compliance teams to ensure alignment with organizational objectives and risk appetite.
• Prepare and present reports on security incidents, metrics, and overall program efficiency to senior management.
• Remain informed about new threats, technologies, and guidelines in cyber security, consistently spotting and recommending improvements.

• Define requirements for deployment, configuration, and monitoring of DLP solutions to detect and prevent unauthorized data exfiltration and leakage.
• Build and complete insider threat detection and response strategies, including the use of behavioral analytics and investigative tools.

• 7+ years of relevant experience or equivalent combination of education and experience.
• High School Diploma or GED equivalent

• Bachelor's degree in computer science, Information Security, or a related field preferred.
• More than 5 years of experience in cyber security operations, with at least 2 years spent in a leadership or supervisory role.
• Comprehensive understanding of essential key and certificate management protocols and technologies (e.g., Sectigo, Digicert, Thales Hardware Security Modules, Venafi, Key Factor, Palo Alto Networks, Microsoft ADCS).
• Hands-on experience with DLP solutions (e.g., Digital Guardian, Palo Alto, Microsoft Purview DLP, Forcepoint, Broadcom, Proofpoint) and platforms for monitoring insider threats.
• Strong understanding of security frameworks (NIST, ISO 27001) and regulatory mandates.
• Excellent analytical, problem-solving, and communication skills.

• Experience with SIEM, SOAR, and incident response tools.
• Ability to manage multiple projects and priorities in a fast-paced environment.
• Demonstrated ability to mentor and develop team members.
• Strong organizational and documentation skills.
• Relevant certifications preferred (e.g., CISSP, CISM).

Ally's compensation program offers market-competitive base pay and pay-for-performance incentives (bonuses) based on achieving personal and company goals. But Ally’s total…