Info Security Senior Manager - Cyber Threat Fusion Center

Wells Fargo & Company•Chandler, AZ

About The Position

Wells Fargo is seeking an experienced cybersecurity leader to serve as a Senior Manager within the Cyber Threat Fusion Center (CTFC) organization. The CTFC monitors, detects, investigates, escalates, and responds to cybersecurity threats affecting Wells Fargo. The role leads CTFC managers and cybersecurity technical resources and is accountable for organizational operational effectiveness, readiness, and continuous improvement. The Senior Manager establishes priorities and consistent practices across teams and shifts and maintains effective operational coverage during routine operations and elevated cyber activity. The position provides senior leadership during significant cybersecurity incidents, coordinates complex cross-functional response, and ensures appropriate escalation and communication to cybersecurity and technology leadership. It advances CTFC capabilities, detection and response processes, operational governance, and the use of lessons from incidents, threat activity, and operational performance to achieve measurable improvements. The leader develops CTFC managers and technical talent, drives workforce and succession planning, sets performance expectations, and fosters accountability, technical excellence, collaboration, and continuous improvement. The role requires cybersecurity and incident response expertise, experience leading leaders and multidisciplinary technical teams, and the ability to influence senior stakeholders across cybersecurity, technology, risk, and business organizations. It also includes appropriate use of AI in security operations while validating outputs and accounting for model limitations, security risks, data-handling requirements, and applicable security, compliance, privacy, risk, and ethical standards. Employees are accountable for applicable risk programs and Wells Fargo policies and procedures, timely escalation and remediation of issues, and sound risk decisions. The job posting’s end date is October 27, 2026; it may be removed earlier due to applicant volume.

Requirements

7+ years of Information Security Engineering experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination of these.
3+ years of management or leadership experience.
Experience leading managers, team leads, or multiple cybersecurity or technical teams.
Demonstrated experience leading security operations, cyber incident response, threat detection, or comparable cybersecurity operational functions.
Demonstrated experience providing leadership during significant or complex cybersecurity incidents.

Nice To Haves

Experience leading multiple operational teams and people leaders in a 24x7 or mission-critical cybersecurity environment.
Experience managing SOC managers, technical leads, senior incident responders, or comparable cybersecurity leadership roles.
Experience leading geographically or organizationally distributed cybersecurity operations.
Demonstrated ability to establish operating models, governance, performance expectations, and consistent practices across multiple teams or shifts.
Ability to coordinate complex response across cyber defense, infrastructure, applications, cloud, risk, legal, communications, and business organizations.
Experience briefing senior executives on significant incidents, operational risks, emerging threats, and security operations performance.
Experience developing managers and senior technical professionals and building leadership succession and technical talent pipelines.
Strong understanding of cybersecurity detection and response methodologies, threat intelligence, threat hunting, malware analysis, digital forensics, and adversary tactics, techniques, and procedures.
Experience overseeing responses to malware, phishing, insider threat, credential compromise, ransomware, data loss, cloud security events, and network intrusions.
Experience leading root cause analysis, incident containment, eradication, recovery, post-incident review, and corrective-action activities.
Experience developing and using SOC metrics, service-level objectives, quality measures, and risk indicators to evaluate operational effectiveness and drive continuous improvement.
Knowledge of MITRE ATT&CK, Cyber Kill Chain, NIST incident response practices, and security operations best practices.
Experience with SIEM, SOAR, EDR, NDR, Threat Intelligence Platforms, case management platforms, cloud security technologies, and security analytics capabilities.
Experience driving automation, orchestration, and technology modernization initiatives within security operations.
Ability to translate cybersecurity operational issues and technical risk into clear business- and executive-level communications.

Responsibilities

Lead the CTFC organization, including managers and cybersecurity technical resources responsible for monitoring, detection, investigation, escalation, and response to threats and incidents.
Lead, coach, and develop CTFC managers and technical leaders, establishing accountability for operational execution, people leadership, technical excellence, and service delivery.
Provide strategic and operational leadership for detection, containment, mitigation, escalation, and resolution of cybersecurity events.
Establish consistent operating practices, priorities, performance expectations, and decision-making across CTFC teams, shifts, and technical functions.
Maintain awareness of significant cyber threats, incidents, operational risks, and emerging issues; ensure appropriate prioritization and escalation.
Provide senior leadership for high-severity, complex, or enterprise-impacting incidents, coordinating decisions, escalation, communication, and resolution.
Provide oversight and escalation support to CTFC managers and incident leaders, particularly for cross-organizational events, executive engagement, or significant operational or business risk.
Partner with cybersecurity, technology, risk, and business leaders to align CTFC operations with information security policies, standards, organizational priorities, and risk management objectives.
Provide subject matter leadership in security operations, threat detection, incident response, threat hunting, threat intelligence, and emerging adversary tactics, techniques, and procedures.
Oversee analysis and correlation of security alerts, threat intelligence, and security telemetry to identify malicious activity, emerging threats, and opportunities to improve detection and response.
Establish and monitor operational performance measures, service-level objectives, quality measures, and risk indicators; identify systemic issues and drive improvement.
Improve CTFC processes, organizational structures, workflows, escalation paths, technologies, and operating practices.
Ensure security operations procedures, response playbooks, escalation criteria, and operational documentation are developed, maintained, governed, and optimized.
Collaborate with cybersecurity engineering, detection engineering, threat intelligence, threat hunting, automation, and platform teams to improve technologies, detection capabilities, telemetry, and response automation.
Translate operational trends, incident activity, threat intelligence, and performance data into actionable recommendations for cybersecurity leadership.
Build partnerships with senior cybersecurity, technology, risk, and business leaders to communicate operational risks, significant incidents, emerging threats, capability needs, and priorities.
Manage workforce strategy, capacity, scheduling, and personnel and technical resource allocation to maintain operational readiness and coverage.
Lead recruiting, organizational planning, succession planning, and talent management for CTFC management and technical roles.
Mentor and develop CTFC managers and senior technical professionals, establishing development paths and strengthening leadership and technical capability.
Promote accountability, disciplined execution, constructive challenge, collaboration, continuous learning, and operational resilience.
Identify systemic operational risks, capability gaps, and recurring failure patterns; drive cross-functional remediation.
Represent CTFC operational priorities and requirements in cybersecurity strategy, investment, technology, and transformation initiatives.
Use AI, where appropriate, to accelerate analysis, automation, troubleshooting, documentation, and security operations activities.
Apply technical judgment to validate and integrate AI-assisted outputs into operational processes and solutions.
Ensure AI use aligns with applicable security, compliance, privacy, risk, and ethical standards, accounting for model limitations, security risks, and data-handling and operational considerations.
Fulfill applicable risk-program and policy obligations, monitor and escalate risks and issues, remediate issues in a timely and effective manner, and make sound risk decisions.