Information Security Manager ONI

all O'Neal Industries' Affiliates•Birmingham, AL

About The Position

The Information Security Manager operates and matures ONI’s enterprise security program in partnership with the Director of IT, aligning security investments and projects with identified risks and business requirements. The role oversees security governance, risk and compliance across ONI and its affiliate companies, including risk assessments, audits, remediation, security policies, framework mapping, audit documentation, and responses to customer, insurance, contractual, and regulatory security requirements. The manager leads high-severity incident response and oversees security operations, including vulnerability management, SIEM, managed detection and response, threat intelligence, dark web monitoring, and security vendor performance. The role guides security architecture and technology, strengthens identity and cloud security across the Microsoft environment, and partners with plant and operations leadership to extend security visibility and controls into OT/ICS and manufacturing environments. The position also leads data protection and emerging technology governance; oversees third-party risk; supervises the Cybersecurity Engineer and other assigned staff; manages security awareness and training; reports cybersecurity metrics to operational and executive audiences; and leads cross-functional security projects.

Requirements

At least five years of IT experience, including at least three years in a dedicated information security role and at least two years in a supervisory or team-lead capacity.
Bachelor’s degree or higher in Cybersecurity, Information Security, Information Systems, Engineering, Computer Science, or a related field; equivalent experience combined with relevant certification will be considered.
Demonstrated experience in risk assessment, incident management, and project management.
Working knowledge of a recognized security framework, such as NIST 800-53, NIST SP 800-171, CMMC, CIS Controls, or ISO 27001, and experience mapping controls and evidence to it.
Strong written and verbal communication skills, including the ability to explain technical risk in business terms to non-technical audiences.
Hands-on familiarity with SIEM, endpoint detection and response, vulnerability management, firewalls, email security, identity and access management, and backup and recovery.
Experience securing a Microsoft enterprise environment, including Active Directory and Entra ID, Microsoft 365, Microsoft Defender, and Intune.
Strong leadership skills and ability to work effectively with business managers, IT engineering, and IT operations staff.
Excellent analytical and problem-solving skills.
Ability to build relationships with ONI and affiliate-company personnel at all levels and across business units and understand business imperatives.
Desire to explore and learn new things.

Nice To Haves

Industry certification such as CISSP, CISM, CRISC, GIAC, or Microsoft security certifications.
Experience with tools in the technology stack, such as Crowdstrike, Cloudflare, Microsoft Defender, Microsoft Entra ID, and Security Scorecard.
Experience in manufacturing, metals distribution, or other industrial environments, including exposure to OT/ICS security.
Experience working within or partnering with large, complex, or decentralized multi-company organizations.
Knowledge and experience developing and documenting security architecture and plans, including strategic, tactical, and project plans.
Understanding of operating system internals and network protocols.
Experience in application security testing, including white-box, black-box, and code review.
Experience in system security testing, including vulnerability scanning and penetration testing.
Experience managing MSSP or other outsourced security relationships.
Strong customer focus, with the ability to manage expectations, provide a superior client experience, and build long-term relationships.

Responsibilities

Operate and mature the enterprise security program in partnership with the Director of IT, aligning investments and projects to identified risks and business requirements.
Direct recurring risk assessments and control audits across ONI and affiliate companies; maintain the enterprise risk register and drive remediation to closure.
Develop, maintain, and communicate security policies, standards, and procedures; map controls to recognized frameworks and keep documentation audit-ready.
Own responses to customer security questionnaires, cyber insurance applications and attestations, and contractual or regulatory security obligations.
Help affiliate-company resource owners and IT staff understand and remediate findings from internal and external security audits.
Manage high-severity incident response from triage through containment, forensic analysis, executive communication, and post-incident review.
Maintain and test the incident response plan and playbooks; coordinate tabletop exercises with IT and business leadership.
Direct operational management of vulnerability management, SIEM and managed detection and response services, threat intelligence platforms, and dark web monitoring.
Manage MSSP and security vendor performance against service levels, addressing gaps in coverage or responsiveness.
Ensure consistent application of security standards and provide configuration guidance and change control for firewall, asset management, endpoint, and backup and recovery systems.
Strengthen identity and cloud security across the Microsoft estate, including Active Directory and Entra ID, Conditional Access, privileged access management, Microsoft Defender, Intune, Microsoft 365, and SaaS security.
Partner with plant and operations leadership to extend asset visibility, network segmentation, and monitoring into OT/ICS and manufacturing environments while accounting for plant-floor availability and safety constraints.
Evaluate, pilot, recommend, and lead implementation of security technologies across ONI and affiliate environments.
Lead data classification, data loss prevention, and insider risk initiatives to protect sensitive business and customer information.
Establish and maintain governance for AI and other emerging technologies, including acceptable-use standards, data-handling requirements, vendor and model review, and monitoring for unsanctioned tools.
Oversee third-party risk assessments, including vendor due diligence, security and privacy contract terms, and ongoing monitoring of critical suppliers and service providers.
Maintain an inventory of third parties with access to ONI systems or data and their assessed risks.
Supervise the Cybersecurity Engineer and other assigned security staff; set objectives, guide performance, and support professional development.
Manage and measure the effectiveness of security awareness and training programs, including phishing simulations and role-based training.
Lead analysis and reporting of cybersecurity metrics and KPIs for operational and executive audiences, including periodic updates to senior leadership.
Lead cross-functional project teams, define scope, schedule, and resource requirements, and deliver security projects on time and on budget.