Lead, Cybersecurity Architecture & Operations

Culligan International•Rosemont, IL

2d•$140,000 - $180,000•Hybrid

About The Position

We are seeking a seasoned, self-motivated, hands-on cybersecurity leader to serve as the technical anchor of our global security program. Reporting directly to the Global CISO, you will own the architecture and day-to-day operation of our core security capabilities—SaaS and data security posture management, vulnerability management, SIEM, and SOC operations—across a complex, global environment. This is a player-coach role for someone who wants both strategic influence and technical depth: you will design the architecture, then roll up your sleeves to build, tune, and run it. You will also play a key role in maturing our security controls, evidence, and audit readiness.

Requirements

6+ years of progressive, hands-on experience in cybersecurity engineering, architecture, and/or security operations.
Deep, practitioner-level experience with SSPM and DSPM platforms (e.g., deploying, operating, and driving remediation at scale).
Proven ownership of an enterprise vulnerability management program, including risk-based prioritization and remediation governance.
Hands-on experience administering a SIEM (e.g., detection engineering, log onboarding, tuning) and managing or overseeing a SOC, including MSSP/MDR relationships.
Strong working knowledge of cloud security (AWS, Azure, and/or GCP), identity and access management, and SaaS ecosystems (e.g., M365, Salesforce, Workday).
Experience operating in a global, multi-region environment with distributed teams and follow-the-sun coordination.
Excellent communication skills—able to brief executives, write clear standards, and influence engineers without direct authority.
Self-starter who operates with minimal direction and drives initiatives from concept to steady-state operation.

Nice To Haves

Experience supporting SOX ITGC controls or operating in a public company environment.
Familiarity with frameworks and regulations such as NIST CSF, ISO 27001, CIS Controls, GDPR, and PCI DSS.
Scripting/automation skills (Python, PowerShell, APIs) and experience with SOAR platforms.
Relevant certifications such as CISSP, CISM, GIAC (GCIA, GCIH, GDSA), or cloud security certifications (AWS/Azure security specialty, CCSP).
Experience in manufacturing, consumer products, or other distributed-operations industries.

Responsibilities

Define and maintain the enterprise security architecture and reference patterns across cloud, SaaS, network, endpoint, and identity domains.
Deploy, operate, and continuously tune our SSPM platform; drive remediation of SaaS misconfigurations, risky integrations, and identity/permission sprawl across the global SaaS estate.
Lead DSPM implementation and operations—discover, classify, and protect sensitive data across cloud and on-premises stores; partner with privacy and legal on data governance.
Own the end-to-end vulnerability management lifecycle: scanning coverage, risk-based prioritization, remediation SLAs, exception handling, and executive reporting across global infrastructure and applications.
Administer and optimize the SIEM platform—log source onboarding, parsing, detection engineering, use-case development, and cost/ingestion management.
Run day-to-day SOC operations, including oversight of MSSP/MDR partners; mature triage, escalation, and incident response playbooks; lead and coordinate response to security incidents across time zones.
Strengthen controls, documentation, and evidence to support SOX ITGC and internal/external audits; conduct application and technology security assessments to evaluate risk and ensure compliance with security standards.
Track threat actor activity relevant to our industry and translate it into detections, hardening priorities, and leadership briefings.
Partner with IT, infrastructure, application, and business teams across regions; mentor analysts and engineers and raise the technical bar of the broader team.
Evaluate, select, and integrate security tooling; manage vendor relationships and drive consolidation and automation where it adds value.