Cybersecurity Security Operations Center Manager

Sherwin-Williams•Cleveland, OH

6d•Remote

About The Position

The Cybersecurity Security Operations Center (CSOC) Manager leads and oversees administration of the CSOC, including security engineers and analysts. The team monitors and alerts on cybersecurity events, maintains current and future technologies, and analyzes threat data to improve the organization’s security posture. The manager balances tactical response to immediate threats with strategic initiatives assigned by senior leadership, and provides calm, focused leadership during incident response. The role also requires leading initiatives and anticipating future team needs by staying informed about technology platforms and the cybersecurity industry. The manager oversees employee performance and development, staffing, on-call rotations, training, vendor relationships, tools, and the CSOC budget. During incidents, the manager coordinates with management and the team to support timely notification and containment, document progress, and conduct post-mortem reviews. The role also ensures regulatory compliance, access controls, alert version control, and collaboration with Cyber Threat Intelligence and other departments. The position contributes to CSOC strategy and planning, including employee development plans, governance board presentations, annual spending plans, budget forecasting, improvements to incident response and threat detection, and enterprise logging and monitoring strategies. It also oversees or conducts compliance assessments and evaluations of new security tools, documenting their security posture, capabilities, and vulnerabilities against relevant information assurance policies. This is a remote position. Travel may be required but should not exceed 10% of work time. Work outside the standard 7.5-hour office workday may be required, with on-call availability. The position is not eligible for work-authorization sponsorship now or in the future. Applicants must be legally authorized to work in the United States without company sponsorship. A criminal-history review may be conducted because the role involves contact with employees and access to confidential, proprietary, or valuable information.

Requirements

Bachelor’s degree or foreign equivalent in a related field, or equivalent experience.
12 or more years of IT and/or cybersecurity experience.
8 or more years of IT security experience.
8 or more years managing a team of direct reports.
At least 1 year of experience with cybersecurity investigations and incident response.
At least 1 year of experience in process analysis and improvement.
Background in metrics and reporting.
Experience identifying and implementing solutions to complex business problems.
Understanding of operating systems such as z/OS, Windows, UNIX, Linux, and AIX, with an emphasis on vulnerability assessment and hardening.
Ability to analyze reports using incident or threat frequency, severity, and duration data.
Must be at least 18 years old.
Must be legally authorized to work in the United States without company sponsorship.

Nice To Haves

Experience in a Security Operations Center or working with a Managed Security Service Provider.
Supervisory and/or management experience.
Budget management experience.
Vendor management experience.
Understanding of log management processes and programs.
Certifications such as Lean, CISSP, SANS GIAC, or CISM.
Knowledge of project management concepts and tools such as JIRA or Planner.
Experience delivering metrics that demonstrate proof of value and key performance indicators.
Understanding of CVSS, CVE, CWE, CPE, CCE, OVAL, SCAP, and/or other standards.
Familiarity with IT and OT detection and response functions.
Familiarity with email security tools such as Proofpoint, Abnormal Security, and O365.
Understanding of threat analysis and threat intelligence.
Experience with Security Information and Event Monitoring products such as Sumo Logic or Splunk.
Experience with vulnerability management products such as Qualys.
Experience using key performance indicators to track analyst workloads and the efficiency of detection signatures, rules, and monitoring technologies.
Experience benchmarking and implementing industry best practices to mitigate potential threats.
Experience supporting the preparation of reports and communicating status and results.
Familiarity with SOC-CMM.

Responsibilities

Manage direct-report employees, including midyear and annual evaluations and appropriate growth or performance-improvement actions.
Manage the SOC on-call rotation and employee time off.
Provide regular training and mentorship to support knowledge-sharing within the team.
Hire staff or contract outside services when needed to supplement team capabilities.
Manage existing and future vendor relationships, including support issues, contract renewals and discrepancies, bi-weekly meetings, and Quarterly Business Reviews.
Track tool performance and utilization to measure return on investment and inform future evaluation or rationalization.
Identify opportunities to evaluate tools and services, working closely with the Security Threat Architect.
Manage the day-to-day CSOC budget.
Lead the team and communicate with management during incident response; ensure timely notification and containment, communicate and document progress, and follow through with post-mortem reviews.
Ensure CSOC compliance with internal and external auditor requirements through adherence to policies and procedures.
Maintain version control of SOC alerts and least-privilege access to logs and investigation data.
Ensure coordination between the CSOC and Cyber Threat Intelligence team.
Work with other departments to identify root causes of security incidents and develop mitigation strategies.
Develop Individual Development Plans with employees and coordinate with management and Human Resources to align plans with business needs and career goals.
Build and present materials for monthly Governance Board meetings regarding existing or future spending.
Plan and prioritize annual CSOC spending in support of Operational Plan Development and advise upper management on budget forecasts.
Improve incident response times, reduce false positives and extraneous alerts, and enhance threat detection capabilities.
Work with CSOC and architecture teams to determine technology and resource requirements.
Engage with other service families and departments to address CSOC logging and monitoring needs and develop enterprise logging and monitoring strategies and solutions.
Stay informed about business and technological developments to prepare the CSOC’s future posture.
Work with upper management to understand budget availability and shape CSOC efforts.
Supervise the team and/or conduct compliance assessments, including Proof of Value or Proof of Concept evaluations for new security tools.
Evaluate software applications, systems, or networks and document security posture, capabilities, and vulnerabilities against relevant information assurance policies.
Assist with other projects as required to contribute to organizational efficiency and effectiveness.