Information Security Operations Manager

AllianceBernstein LP•Nashville, TN

3d•Hybrid

About The Position

AllianceBernstein is seeking an Information Security Operations Manager to lead its Information Security Analyst Team within Global Technology & Operations. The role is based at the company’s Nashville, Tennessee headquarters, with four days in the office and one day remote each week. The Information Security Operations team safeguards the firm’s technology and information assets by identifying threats, monitoring and responding to security events, and enhancing the firm’s security posture. The team is part of Infrastructure Risk Management, which runs an enterprise-wide integrated infrastructure risk management program covering cybersecurity, information security, data privacy, physical security, and business continuity. The position reports to the Director of Information Security Risk and Operations. This is a hands-on player/coach role that leads a team delivering information security analysis, incident response, and information risk management support. The manager works alongside analysts, providing guidance, coaching, and training, and collaborates with corporate business units including global enterprise infrastructure and technology, corporate compliance, security assurance, global technology operations, and other infrastructure risk teams. The team serves as an incident response team and control group, ensuring security operational procedures are followed and risks are addressed promptly. The team maintains a 24/7/365 on-call rotation, and the manager participates alongside the team. The manager leads daily information security operations in alignment with business objectives and risk tolerance; develops and continuously improves security procedures; participates in incident response and threat detection as a hands-on escalation point; tracks and reports security metrics such as MTTD and MTTR; collaborates with IT, legal, compliance, privacy, and executive teams; uses automation and threat intelligence to improve operations; manages vendor relationships; and mentors analysts through real-time incident handling, threat hunting, and query development.

Requirements

Ideally 8 or more years of experience in Information Security and/or Information Technology in an operations role.
At least 6 years of prior experience in a role exclusively responsible for information security incident response.
Prior experience managing or leading people on an information security team.
Experience leading incident response in a global environment, including hands-on triage, investigation, and containment alongside the team.
Willingness to participate in the 24/7/365 on-call rotation alongside the team.
Experience building and maintaining SOAR playbooks.
Fluency with Splunk Processing Language (SPL), YARA-L, and Kusto Query Language (KQL).
Experience working with JIRA, ServiceNow, or similar platforms.
Experience working with DLP platforms.
Experience creating, collecting, and assembling metrics for reporting.
Experience working with hybrid on-premises and cloud technology platforms and applications.
Extensive experience securing and/or troubleshooting computer systems and networks.
Extensive experience with malware assessment and incident response.
Experience with SIEM platforms.
Experience reviewing logs, scripting tasks, or creating structured queries and regex searches.
Solid understanding of AI, its associated risks, and security use cases.
Awareness of information security best practices and financial regulatory requirements.
Excellent problem-solving and risk decision-making skills.
Excellent verbal and written communication skills, including the ability to communicate clearly to several levels of management and adapt communication to varied technical, business, and cultural backgrounds.
Ability to represent data in the most meaningful form.
Ability to think and operate independently with limited guidance.
Bachelor’s degree in Computer Science, Information Systems, or Information Security; equivalent experience may be considered.
Excellent program and project management, prioritization, and organizational skills.
Acute attention to detail and solid leadership abilities, with a genuine desire to lead by example and stay close to the work.

Nice To Haves

Experience with Splunk and Microsoft Sentinel.
CISSP, CISM, OSCP, CRISC, GSEC, GCIH, GCIA, GCFA, GFCE, or GSE certification; other advanced certifications are also considered.

Responsibilities

Lead the daily operations of the information security operations program, aligning activities with business objectives and risk tolerance.
Develop, implement, and continuously improve security procedures.
Participate hands-on in incident response and threat detection, serving as an escalation point and ensuring rapid, effective resolution.
Track and report key security metrics, such as MTTD and MTTR, to leadership.
Collaborate with IT, legal, compliance, privacy, and executive teams on holistic risk management.
Leverage automation and threat intelligence to enhance security operations.
Manage vendor relationships.
Coach and mentor analysts through hands-on support, including real-time incident handling, threat hunting, and query development.
Lead a team providing information security analysis, incident response, and information risk management support to the business.
Participate in the team's 24/7/365 on-call rotation.