Cybersecurity Security Operations Center Manager

Sherwin-Williams • Cleveland, OH

6d • $130,507 - $169,667 • Remote

About The Position

The Cybersecurity Security Operations Center (CSOC) Manager leads and oversees the CSOC, including security engineers and analysts. The CSOC monitors and alerts on cybersecurity events, maintains current and future technologies, and analyzes threat data to improve the organization’s security posture. The role balances tactical response to immediate threats with strategic initiatives set by senior leadership. It calls for strong analytical and technical skills, calm leadership during incident response, and the ability to advance team initiatives while staying informed about technology and cybersecurity developments.

The manager oversees personnel, on-call coverage, training, hiring, vendor relationships, tool performance, budget, compliance, and incident response. The role also supports employee development, annual planning and spending, governance reporting, technology and resource planning, and enterprise logging and monitoring strategies. The manager supervises or performs security-tool assessments, including proofs of value or concept, and documents the security posture, capabilities, and vulnerabilities of software, systems, or networks against applicable information-assurance policies.

This is a remote position. Travel may be required but should not exceed 10% of work time. Work outside the standard 7.5-hour office day may be required, with on-call availability. Applicants must be legally authorized to work in the United States without current or future employer sponsorship. The role includes access to confidential and proprietary information, and the company states that a criminal-history review is necessary.

Requirements

• Bachelor’s degree or foreign equivalent in a related field, or equivalent experience.
• 12 or more years of IT and/or cybersecurity experience.
• 8 or more years of IT security experience.
• 8 or more years managing a team of direct reports.
• At least 1 year of experience with cybersecurity investigations and incident response.
• At least 1 year of experience in process analysis and improvement.
• Background in metrics and reporting.
• Experience identifying and implementing solutions to complex business problems.
• Understanding of operating systems such as z/OS, Windows, UNIX, Linux, and AIX, with an emphasis on vulnerability assessment and hardening.
• Ability to analyze reports using incident or threat frequency, severity, and duration data.
• Must be at least 18 years old.
• Must be legally authorized to work in the United States without company sponsorship.

Nice To Haves

• Experience in a Security Operations Center or working with a Managed Security Service Provider.
• Supervisory and/or management experience.
• Budget management experience.
• Vendor management experience.
• Understanding of log management processes and programs.
• Certifications such as Lean, CISSP, SANS GIAC, or CISM.
• Knowledge of project management concepts and tools such as JIRA or Planner.
• Experience delivering metrics that demonstrate proof of value and key performance indicators.
• Understanding of CVSS, CVE, CWE, CPE, CCE, OVAL, SCAP, and/or other standards.
• Familiarity with IT and OT detection and response functions.
• Familiarity with email security tools such as Proofpoint, Abnormal Security, or O365.
• Understanding of threat analysis and threat intelligence.
• Experience with Security Information and Event Monitoring (SIEM) products such as Sumo Logic or Splunk.
• Experience with vulnerability management products such as Qualys.
• Experience using key performance indicators to track analyst workloads and the efficiency of detection signatures, rules, and monitoring technologies.
• Ability to benchmark and implement industry best practices to mitigate potential threats.
• Experience supporting report preparation and communicating status and results.
• Familiarity with SOC-CMM.

Responsibilities

• Manage direct-report employees, including midyear and annual evaluations and addressing opportunities for growth or performance improvement.
• Manage the SOC on-call rotation and time off.
• Provide regular training and mentorship to promote knowledge-sharing.
• Hire staff or contract external services to supplement team capabilities as needed.
• Manage existing and future vendor relationships, including support issues, contract renewals and discrepancies, bi-weekly meetings, and Quarterly Business Reviews.
• Track tool performance and utilization to measure return on investment and support future tool evaluation or rationalization.
• Identify opportunities to evaluate tools and services in collaboration with the Security Threat Architect.
• Manage the day-to-day CSOC budget.
• Lead the team and communicate with management during incident response, ensuring timely notification and containment, documenting progress, and completing post-mortem reviews.
• Ensure CSOC compliance with internal and external audit requirements and policies and procedures, including version control of SOC alerts and least-privilege access to logs and investigation data.
• Ensure synchronization and collaboration between the CSOC and the Cyber Threat Intelligence team.
• Work with other departments to determine the root causes of security incidents and develop mitigation strategies.
• Work with employees, management, and Human Resources on individual development plans that meet business needs and provide measurable career advancement steps.
• Prepare and present monthly Governance Board materials concerning existing or future spending.
• Plan and prioritize annual CSOC spending in support of operational plan development and advise upper management on budget forecasts.
• Improve incident response times, reduce false positives and extraneous alerts, and enhance threat detection capabilities.
• Work with the CSOC and architecture teams to determine technology and resource requirements.
• Engage with other service families and departments on CSOC logging and monitoring needs and enterprise logging and monitoring strategies and solutions.
• Stay informed about business and technological developments to prepare the CSOC’s future posture.
• Work with upper management to understand budget availability and shape CSOC efforts.
• Supervise or perform compliance assessments, including Proof of Value or Proof of Concept evaluations for new security tools.
• Evaluate software applications, systems, or networks and document their security posture, capabilities, and vulnerabilities against relevant information-assurance policies.
• Assist with other projects as required to improve organizational efficiency and effectiveness.

Benefits

• The company describes a wide range of benefits covering retirement, health care, well-being, and daily commuting; specific offerings and eligibility are provided through its candidate benefits information.
• The company describes rewards, benefits, and flexibility intended to support health and well-being.
• The company describes learning, skills development, and career-growth opportunities.
• The company describes an inclusive team and a commitment to its communities.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager