Cybersecurity Operations Manager, Ford Energy

Ford • Dearborn, MI

5d • $115,500 - $218,100 • Hybrid

About The Position

Ford Energy is seeking a Cybersecurity Operations Manager to lead, operationalize, and modernize global security monitoring and incident response. The role oversees a hybrid operating model of internal direct reports and an external managed security service provider (MSSP), covering Enterprise IT, Product Cybersecurity, customer-facing applications and connected platforms, and Manufacturing/Operational Technology (OT) environments.

The manager leads 24/7 security monitoring, incident triage and response; manages MSSP performance and service levels; and improves security operations tools, detection quality, threat hunting, and automated response. The role serves as the primary escalation lead and incident commander for complex incidents, including those affecting customer-facing services, and collaborates with plant operations and industrial control system (ICS) engineers on manufacturing security. It also supports compliance and audit readiness, presents operational metrics and security posture to executives and stakeholders, and manages on-call escalation rotations.

The position is based in Dearborn, Michigan, and is hybrid, requiring onsite work four or more days per week. It is leadership level 6, with a salary range of $115,500–$218,100. The role will initially be employed by Ford and is expected to transition to Ford’s wholly owned battery energy storage systems subsidiary within one year. Visa sponsorship is not available.

Requirements

• Minimum 5–7 years of experience in Security Operations (SOC), Threat Intelligence, or Incident Response.
• At least 3 years in a supervisory, management, or technical lead role.
• Demonstrated success managing vendor/MSSP contracts, service delivery SLAs, and teams combining internal engineers and external contractors.
• Hands-on leadership experience operating security functions across enterprise IT, cloud infrastructure, customer-facing applications/platforms, and OT/ICS.
• Working knowledge of application security monitoring, web/API threat detection, and securing customer-facing digital platforms and portals.
• Understanding of ISO 27001, NIST SP 800-82, IEC 62443, or similar frameworks relevant to connected products and critical infrastructure.
• Strong experience serving as Incident Commander during major breach responses, cyberattacks, or critical infrastructure outages.
• Bachelor’s or master’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical field, or equivalent related work experience.
• Must be legally authorized to work in the United States; visa sponsorship is not available.
• Must be able to work onsite four or more days per week in a hybrid arrangement.

Nice To Haves

• Certifications such as CISSP, CISM, GCIH, GCFA, GRID, or GICSP.
• Experience securing customer-facing SaaS platforms, IoT/connected product ecosystems, or remote monitoring applications in electric utility, automotive (EV/BMS), or advanced manufacturing sectors.
• Technical familiarity with Microsoft Sentinel, Defender XDR, Palo Alto Networks, web application firewalls, API security tools, and OT monitoring solutions such as Dragos, Claroty, or Nozomi.
• Experience partnering with product and customer experience teams to embed security monitoring into customer-facing application development and support lifecycles.
• Ability to explain technical incident details, business risks, and remediation strategies to C-level executives and customer-facing stakeholders.
• Decisive, strategic leadership capable of unifying IT, OT, Product, and customer-facing application operations into a proactive defense posture.

Responsibilities

• Lead, mentor, and manage the internal security operations team and oversee MSSP partner performance, SLAs, escalation pathways, and daily operations.
• Lead 24/7 security monitoring, incident triage, and response across enterprise IT networks, cloud platforms, product and IoT telemetry, customer-facing portals and applications, and manufacturing/OT facilities.
• Own security monitoring, threat detection, and incident response for customer-facing applications, portals, APIs, authentication systems, and customer data pathways.
• Monitor threat activity and analyze security telemetry across external-facing platforms and connected infrastructure linking customer environments to cloud and support systems.
• Optimize SIEM/SOAR platforms, detection rules, threat-hunting playbooks, and automated response workflows to improve MTTD and MTTR.
• Serve as primary escalation lead and incident commander during complex cybersecurity incidents, leading cross-functional containment, eradication, root-cause analysis, and customer communications.
• Work with plant operations and ICS engineers to improve real-time visibility, anomaly detection, and incident handling across manufacturing plants.
• Support security logging, audit readiness, and incident response procedures aligned with applicable security frameworks and critical infrastructure requirements.
• Develop, track, and present operational security metrics, threat landscapes, customer application security posture, and SOC effectiveness KPIs to executive leadership and business stakeholders.
• Act as senior operational contact and manage on-call escalation rotations for critical security incidents, including incidents affecting customer-facing platforms.

Benefits

• Immediate medical, dental, vision, and prescription drug coverage.
• Flexible family care days, paid parental leave, new parent ramp-up programs, and subsidized backup childcare.
• Family-building benefits, including adoption and surrogacy expense reimbursement and fertility treatments.
• Vehicle discount program for employees and family members, and management leases.
• Tuition assistance.
• Employee resource groups.
• Paid time off for individual and team community service.
• Paid holidays, including the week between Christmas and New Year’s Day.
• Paid time off and the option to purchase additional vacation time.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager