Information Security Operations Manager

AllianceBernstein•Nashville, TN

4d•Hybrid

About The Position

The Information Security Operations Manager leads AllianceBernstein’s Information Security Analyst Team within Global Technology & Operations. The team safeguards the firm’s technology and information assets by identifying threats, monitoring and responding to security events, and improving the firm’s security posture. It operates within Infrastructure Risk Management, which manages cybersecurity, information security, data privacy, physical security, and business continuity as an enterprise-wide program led by the Chief Security Officer. This is a hands-on player-coach role. The manager leads daily security operations, provides guidance and training to analysts, and works with teams across technology, compliance, security assurance, and infrastructure risk. The team provides security analysis, incident response, and information risk management support, and serves as an incident response team and control group to ensure operational procedures are followed and risks are addressed promptly. The role participates in a 24/7/365 on-call rotation and reports to the Director of Information Security Risk and Operations. The position is based at AllianceBernstein’s Nashville, Tennessee headquarters, with four days in the office and one day remote each week.

Requirements

Ideally, 8 or more years of experience in Information Security and/or Information Technology in an operations role.
At least 6 years of prior experience in a role exclusively responsible for information security incident response.
Prior experience managing or leading people on an information security team.
Experience leading incident response in a global environment, including hands-on triage, investigation, and containment.
Willingness to participate in a 24/7/365 on-call rotation; this is a hands-on manager position.
Experience building and maintaining SOAR playbooks.
Fluency with Splunk Processing Language (SPL), YARA-L, and Kusto Query Language (KQL).
Experience with JIRA, ServiceNow, or similar platforms.
Experience working with DLP platforms.
Experience creating, collecting, and assembling metrics for reporting.
Experience with hybrid on-premises and cloud technology platforms and applications.
Extensive experience securing and/or troubleshooting computer systems and networks.
Extensive experience with malware assessment and incident response.
Experience with SIEM platforms.
Experience reviewing logs, scripting tasks, or creating structured queries and regex searches.
Solid understanding of AI, its associated risks, and security use cases.
Awareness of information security best practices and financial regulatory requirements.
Excellent problem-solving and risk decision-making skills.
Excellent verbal and written communication skills, including the ability to communicate with different management levels and adapt to technical, business, and cultural audiences across business units.
Ability to represent data in a meaningful form.
Ability to think and operate independently with limited guidance.
Bachelor’s degree in Computer Science, Information Systems, or Information Security; equivalent experience may be considered.
Excellent program and project management, prioritization, and organizational skills.
Acute attention to detail and solid leadership abilities, with a genuine desire to lead by example and stay close to the work.

Nice To Haves

Experience with Splunk and Microsoft Sentinel SIEM platforms.
CISSP, CISM, OSCP, CRISC, GSEC, GCIH, GCIA, GCFA, GFCE, or GSE certification; other advanced certifications are also considered.

Responsibilities

Lead the daily operations of the information security operations program, aligning it with business objectives and risk tolerance.
Develop, implement, and continuously improve security procedures.
Participate hands-on in incident response and threat detection, serving as an escalation point and ensuring rapid, effective resolution.
Track and report key security metrics, such as MTTD and MTTR, to leadership.
Collaborate with IT, legal, compliance, privacy, and executive teams on holistic risk management.
Use automation and threat intelligence to enhance security operations.
Manage vendor relationships.
Coach and mentor analysts through hands-on support, including real-time incident handling, threat hunting, and query development.
Lead a team providing information security analysis, incident response, and information risk management support.
Participate in the team’s 24/7/365 on-call rotation.