Cyber Security Incident Response Manager

ITW•Glenview, IL

2d•Onsite

About The Position

Since its founding more than 100 years ago, ITW has become one of the world’s leading diversified manufacturers of specialized industrial equipment, consumables, and related service businesses. We place a high premium on developing innovative solutions–most of which are developed in tandem with our customers. And we continue to ensure that our customers receive timely, cost-effective service for our innovative products. ITW’s differentiated business model comprises unique core capabilities: our proprietary 80/20 business process, customer-back innovation, and our well-known decentralized entrepreneurial culture. These capabilities are unmistakably ITW—and key to our longevity and strong performance. ITW’s products and solutions are at work all over the world, in deep-sea oil rigs, aerospace technology, bridges and wind turbines, healthcare, the spaces in which we live and work, the cars we drive, and the mobile devices we rely on. We are never, whether we know it or not, more than a few steps from an innovative ITW solution. ITW (NYSE: ITW) is a Fortune 300 global multi-industry manufacturing leader with revenue of $15.9 billion in 2024. and employs ~44,000 people operating in 51 countries. Our headquarters in Glenview, IL, features a fitness center at no cost to the employees, a cafe, outdoor volleyball courts, walking trails around the facility, employee resource groups, corporate discounts, dry cleaning services, covered/outdoor parking, and much more. We are just a block away from the nearest Metra station, and it is a quick 20-minute train ride to downtown Chicago, museums, lakefront, and other activities. More details on our benefits can be found on our website at https://www.itw.com/careers/benefits-compensation/ The Incident Response Manager is part of the Corporate IT Cyber Security team and is responsible for developing, implementing, and maintaining a comprehensive incident response security program. The Incident Response Manager will serve as a senior member of the cyber team and will be responsible for leading the incident response and threat monitoring services for ITW. In this role, this individual will oversee incident tracking and resolution. They will lead incident response services and engage in forensic services when needed. They will conduct lessons learned for cyber events and provide incident reports to management. In this role, this individual will lead the incident response services that monitor cyber incidents at ITW Corporate and ITW divisions. This role will oversee all aspects of the incident response program including incident tracking, resolution and reporting. This person will lead the cyber security analysts who are responsible for the day-to-day execution of the incident response services. The Incident Response Manager will review incident response program alerting and monitoring to ensure cyber protections are maintained, improved and properly implemented through performance metrics. This person will be the security subject matter expert for ITW Incident Response and SOC Monitoring services. The Incident Response Manager is expected to be fully aware of the enterprise’s security goals as established by its stated policies, procedures, and guidelines and to actively work towards upholding those goals. This person will be responsible for researching and recommending new cyber security solutions, participate in the creation and or maintenance of policies, standards, baselines, guidelines, and procedures. In addition, the Incident Response Manager will develop and implement threat hunting procedures to protect the enterprise environment. This position requires strong organizational and communications skills to work with both a technical and non-technical audience at all levels. The applicant must also demonstrate an advanced ability to analyze, support, and resolve issues regarding cybersecurity, risk, and compliance. This position will be part of a high-performing team delivering best-in-class IT services to the business.

Requirements

Bachelor's degree in Computer Science, Information Systems, Business or related field required.
7+ years of experience working in an Information Technology role with 3+ years of direct team leadership experience.
Ability to work onsite at the Glenview corporate campus.
Must have had leadership responsibility for leading teams, projects and technology operations.
High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.
Ability to work under pressure; work concurrently on multiple initiatives in different stages and pay attention to detail.
Strong analytical and problem-solving skills to enable effective security incident and problem resolution.
Ability to conduct research into IT security issues and products as required.
Ability to present ideas in business-friendly and user-friendly language.
This position will be part of a high-performing team delivering best-in-class IT services to the business.

Responsibilities

Perform the deployment, integration, and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard best operating.
Recommend additional solutions or enhancements to existing cyber security services to improve overall enterprise security.
Monitor all in-place security solutions for efficient and appropriate operations.
Oversee threat intelligence program, conduct daily reviews of threat landscape, and identify exposure impact to ITW systems.
Respond to and, where appropriate, facilitate resolution of reported security incidents
Review cyber security incidents to identify themes and trends
Participate in Critical Incident Response Planning through testing and maintenance of our plans
Meet with 3rd Party Vendors to review threat factors and activities and ensure prompt, thorough follow up
Lead the team responsible for monitoring system logs, SIEM tools and network traffic for unusual or suspicious activity.
Interpret such activity and make recommendations for resolution.
Lead the incident response team throughout investigation and resolution of security violations
Develop a strong working relationship with the technical operations team to efficiently collaborate on potential security threats, incidents and mitigation efforts