Cybersecurity Third Party Incident/SOC Manager

Truist Bank•Atlanta, GA

12d•Onsite

About The Position

In this role, you will be responsible for leading a specialized security operations function focused on triaging, investigating, and responding to security events and incidents involving third-party vendors, SaaS providers, and external partners. This role maintains a holistic and continuously updated vendor risk profile by correlating technical telemetry and detections, threat intelligence, business criticality and data sensitivity, and historical vendor incidents. The TPSOC Manager ensures vendor-related threats are rapidly assessed, accurately scoped, and translated into actionable business risk decisions.

Requirements

Bachelor’s degree and six to eight years of experience in systems engineering or administration or an equivalent combination of education and work experience
Deep specialized and/or broad functional knowledge in applied enterprise information security technologies including but not limited to firewalls, intrusion detection/prevention systems, network operating systems, identity management, database activity monitoring, encryption, content filtering, and Mainframe security
Previous experience in leading complex IT projects.
English (Required) fluency

Nice To Haves

Master’s degree or MBA and seven (7+) years of experience or an equivalent combination of education and work experience in Information Security banking.
Strong knowledge on cybersecurity risks, frameworks, best practices, and industry/regulatory requirements.
Knowledge and experience in use of cyber security frameworks in assessing programs.
Knowledge or experience delivering Information Security projects.
Knowledge of Cybersecurity Operations - Threat Intelligence, Threat Detection, Security Monitoring, Incident Response.
Knowledge of InfoSec platforms, CrowdStrike, Splunk, SIEM, CyberArk, SailPoint, etc.
CISSP Certification
Banking or financial services experience
Other security certifications (e.g., CCNA Security, GSEC, GCED, GPPA, etc.)
Other technical Certifications (e.g., CCNA, RHCE, MCSE, etc.)

Responsibilities

Lead triage and investigation of vendor breach notifications, SaaS compromises involving third parties, and external exploitation of vendor-managed systems.
Determine whether the organization is impacted and identify affected data, systems, and users.
Coordinate response with SOC, Vendor Risk Management, Cyber Command Center, Legal, Privacy, Compliance, and Application Security teams.
Ensure evidence collection and forensic integrity for vendor-related incidents.
Prepare and present project updates for executive leadership.
May lead IT cybersecurity initiatives and typically leads moderately complex projects and participate in larger, more complex initiatives. Solves complex technical and operational problems.
Build and maintain dynamic vendor risk profiles incorporating data sensitivity and access levels, external risk ratings (e.g., SecurityScorecard, BitSight), threat intelligence and breach history, and internal telemetry and detection results.
Classify vendors by inherent risk, residual risk, and incident likelihood.
Continuously update vendor risk posture based on incidents, new integrations, and external threat activity.
Oversee detection strategy for vendor-related abuse cases and SaaS misuse by third parties.
Partner with Detection Engineering and SOAR teams to improve alert quality and reduce false positives.
Ensure cyber third-party risks are covered by alerts and automated playbooks.
Own and maintain playbooks for vendor breach response, SaaS abuse by third parties, and exposure of vendor-managed assets.
Ensure consistent execution of containment actions, stakeholder notifications, and contractual/regulatory response obligations.
Lead tabletop exercises focused on supply chain and vendor compromise scenarios.
Serve as the primary operational security contact for critical vendors during incidents.
Provide evidence-based assessments of vendor security posture.
Recommend risk treatment actions such as access suspension, integration restrictions, or contract controls.
Define and track KPIs for vendor incident response, detection coverage, and vendor risk trends.
Produce executive-level reporting on vendor-related incidents and emerging supply-chain threats.
Drive maturity improvements in third-party monitoring, automation, and risk correlation.