Lead, Cybersecurity Architecture & Operations

Position: Lead, Cybersecurity Architecture & Operations

Supervisor: Global Chief Information Security Officer

Location: Rosemont, IL

We are seeking a seasoned, self‑motivated, hands‑on cybersecurity leader to serve as the technical anchor of our global security program. Reporting directly to the Global CISO, you will own the architecture and day‑to‑day operation of our core security capabilities—SaaS and data security posture management, vulnerability management, SIEM, and SOC operations—across a complex, global environment. This is a player‑coach role for someone who wants both strategic influence and technical depth: you will design the architecture, then roll up your sleeves to build, tune, and run it.

You will also play a key role in maturing our security controls, evidence, and audit readiness.

• Security architecture:
  Define and maintain the enterprise security architecture and reference patterns across cloud, SaaS, network, endpoint, and identity domains.
• SSPM:
  Deploy, operate, and continuously tune our SSPM platform; drive remediation of SaaS misconfigurations, risky integrations, and identity/permission sprawl across the global SaaS estate.
• DSPM:
  Lead DSPM implementation and operations—discover, classify, and protect sensitive data across cloud and on‑premises stores; partner with privacy and legal on data governance.
• Vulnerability management:
  Own the end‑to‑end vulnerability management lifecycle: scanning coverage, risk‑based prioritization, remediation SLAs, exception handling, and executive reporting across global infrastructure and applications.
• SIEM:
  Administer and optimize the SIEM platform—log source onboarding, parsing, detection engineering, use‑case development, and cost/ingestion management.
• SOC operations:
  Run day‑to‑day SOC operations, including oversight of MSSP/MDR partners; mature triage, escalation, and incident response playbooks; lead and coordinate response to security incidents across time zones.
• Audit and Compliance:
  Strengthen controls, documentation, and evidence to support SOX ITGC and internal/external audits; conduct application and technology security assessments to evaluate risk and ensure compliance with security standards.
• Threat‑informed defense:
  Track threat actor activity relevant to our industry and translate it into detections, hardening priorities, and leadership briefings.
• Global collaboration & mentorship:
  Partner with IT, infrastructure, application, and business teams across regions; mentor analysts and engineers and raise the technical bar of the broader team.
• Tooling & automation:
  Evaluate, select, and integrate security tooling; manage vendor relationships and drive consolidation and automation where it adds value.

• 6+ years of progressive, hands‑on experience in cybersecurity engineering, architecture, and/or security operations.
• Deep, practitioner‑level experience with SSPM and DSPM platforms (e.g., deploying, operating, and driving remediation at scale).
• Proven ownership of an enterprise vulnerability management program, including risk‑based prioritization and remediation governance.
• Hands‑on experience administering a SIEM (e.g., detection engineering, log onboarding, tuning) and managing or overseeing a SOC, including MSSP/MDR relationships.
• Strong working knowledge of cloud security (AWS, Azure, and/or GCP), identity and access management, and SaaS ecosystems (e.g., M365, Salesforce, Workday).
• Experience operating in a global, multi‑region environment with distributed teams and follow‑the‑sun coordination.
• Excellent communication skills—able to brief executives, write clear standards, and influence engineers without direct authority.
• Self‑starter who operates with minimal direction and drives initiatives from…