Cybersecurity Incident Manager - Lead

USAA•San Antonio, TX

3d•Hybrid

About The Position

As a dedicated Cybersecurity Incident Manager - Lead, the candidate selected for this position serves as a Lead within the Cyber Threat Monitoring and Response (CTMR) team, responsible for leading and coordinating cybersecurity incident response activities throughout the incident lifecycle across security, technology, business, and third-party partner organizations. Acts as an Incident Commander during active cybersecurity incidents by establishing response objectives, maintaining situational awareness, coordinating cross-functional response teams, and communicating incident status, business impact, and response actions to stakeholders and senior leadership. This role also supports the ongoing development and maturity of the Cyber Threat Operations Center by driving improvements to incident response processes, operating models, playbooks, training, metrics, and after-action review practices. The successful candidate will identify opportunities to enhance response effectiveness, operational readiness, and cyber resilience through continuous improvement, operational excellence, and the application of industry best practices. Investigates, analyzes, and responds to security anomalies and events (e.g. suspicious behavior, attacks, and security breaches) within USAA's environments using a variety of cyber defense tools to detect and respond to threats. Conducts vulnerability, security configuration, and/or penetration testing assessments of systems and networks. Identifies cyber threats, analyzes operational impacts, and communicates to appropriate stakeholders. Stays current with latest information security threats, exploits, trends, and intelligence.

Requirements

Bachelor's degree OR 4 years of relevant education and/or experience.
8 years of related experience in Information Security, Cybersecurity and/or Information Technology with a security focus to include accountability for complex tasks and/or projects.
6 years of related experience in one of the following domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communications and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, Software Development Security.
Expert level of business acumen in the areas of business operations, risk management, industry practices and emerging trends.
Experience performing security reviews to identify gaps, resulting in recommendations for inclusion in risk mitigation strategies.
Experience investigating potentially malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.

Nice To Haves

Experience leading technical investigations and response activities during cybersecurity incidents, including coordinating responders, prioritizing actions, and validating containment efforts.
Experience across multiple incident response disciplines, including security monitoring, alert triage, incident investigation, case disposition, malware analysis, digital forensics, threat intelligence, endpoint security, network security, identity security, and incident containment.
Demonstrated ability to coordinate cross-functional teams and maintain situational awareness during complex or high-severity cybersecurity incidents.
Experience responding to ransomware, credential compromise, insider threats, data exfiltration, cloud compromise, advanced malware, or other large-scale cyber threats.
Familiarity with proactive cybersecurity activities such as threat hunting, detection engineering, cyber threat intelligence, purple teaming, red teaming, or adversary emulation.
Experience developing and maturing incident response programs, processes, playbooks, operating models, and after-action review programs to improve response capabilities and operational effectiveness.
Experience communicating technical findings, business impact, and response recommendations to senior leadership and stakeholders during active cybersecurity incidents.
Experience coordinating cybersecurity response activities across security, technology, business, and third-party partner organizations.

Responsibilities

Influences and leads efforts across the Information Security department and enterprise as a subject matter expert in their domain.
Leads research efforts and analysis of the latest information security vulnerabilities, threats, exploits, trends and intelligence.
Shares intelligence with the enterprise.
Collaborates in the Intelligence community with external organizations.
Serves as subject matter expert, leads, and improves the vulnerability management, security configuration assessment, and/or penetration testing programs.
Develops analysts through training and knowledge sharing activities.
Monitors internal and external networks, systems, and applications for advanced security anomalies and events (e.g.suspicious behavior attacks, and security breaches).
Trains analysts in incident detection and response.
Leads and improves the incident response program.
Leads and responds to cyber incidents, performing detailed analysis using complex security tools to determine root cause and impact by using a broad range of demonstrated experience (e.g.forensics, networking, servers, coding, etc.) to determine a malicious actor's tactics, techniques, and procedures.
Acts as leader for cyber incidents.
May testify as expert witness in court.
Incorporates discoveries from the incident response process to substantially improve the existing detection capabilities, operational processes, security controls, and overall program.
Prepares and delivers written and verbal briefs with recommendations to senior leadership and external parties on latest threats, alerts, incidents, and improvements.
Drives and directs quality work efforts.
Serves as the primary resource for cross-functional team members on escalated issues of a unique nature.
Maintains expert level knowledge of USAA Information Security standards as well as industry information security best practices, frameworks, laws, and regulations.
Ensures risks associated with business activities are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.