Manager, Cyber Exposure Management

Regions Bank•Hoover, AL

4d•Onsite

About The Position

At Regions, the Cyber Security Manager leads a diverse team of engineers and analysts responsible for daily operations enforcing, monitoring, and managing cyber security controls that protect the bank’s, customers’, and associates’ assets. The role oversees security-control domains including malware defense, network and Internet security, security analytics, threat intelligence and defense, cybercrime, data protection, vulnerability management, and customer authentication. The manager leads Cyber Exposure Management strategy, including Continuous Threat Exposure Management (CTEM) and risk-based prioritization of remediation. The role drives attack surface management, threat exposure analysis, and remediation initiatives across on-premises, cloud, and hybrid environments. It also includes developing an in-house portal for technology owners, automating exposure-management workflows, and integrating threat intelligence and adversary tactics, techniques, and procedures into prioritization strategies. The position partners with Technology, Operations, Digital, and Data teams and other business and technology stakeholders to strengthen risk management, compliance, and cyber security. The manager leads a security team, oversees vendors and security technology investments, and ensures critical vulnerabilities and high-risk findings are addressed within defined service-level objectives. The position is intended to be onsite, with full days in the office three or more days per week; the manager sets the work schedule and in-office expectations. Locations listed for the role are Birmingham, Alabama; Atlanta, Georgia; Nashville, Tennessee; or Charlotte, North Carolina. The posting also lists Riverchase Operations Center in Hoover, Alabama. Relocation assistance and work visa sponsorship are not provided.

Requirements

Bachelor’s degree in a related field and eight years of related experience, or a high school diploma or GED and twelve years of related experience.
Four years of lead or supervisory/managerial experience.
Ability to prioritize assignments while working on multiple projects.
Advanced technical aptitude.
Demonstrated ability to engage project teams and leadership effectively in a corporate setting.
Excellent written and oral communication skills.
Strong ability to predict and plan for unknown threats.
Strong ability to work well with others and prioritize group success.
Understanding of and ability to interpret applicable rules, regulations, and industry guidance.
Must currently be authorized to work in the United States on a full-time basis; Regions will not sponsor work visas for this position.

Nice To Haves

Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or another industry certification.
Good understanding of current internal and external cyber threats to the financial services sector.
Experience managing Information Technology and/or Information Security projects.
Experience with security operations and incident response/handling.

Responsibilities

Develop cyber security architectures, designs, controls, processes, standards, and strategies aligned with Information Security standards, emerging threats, and overall Information Security strategy.
Develop and implement incident response protocols for ongoing threats and attacks.
Communicate the status of the current threat environment, incidents, and projected threats to senior management and executives.
Manage the evaluation and testing of hardware, firmware, and software for potential impacts on systems security.
Coordinate with other managers to integrate Information Security project components with application development, network, server, and mainframe projects.
Partner across Technology, Operations, Digital, and Data to design, implement, and monitor controls that strengthen risk management, compliance, and cyber security and mitigate risk within the company’s risk appetite.
Ensure disciplined change management by evaluating risk and control impacts when designing or implementing changes to processes, systems, products, or services.
Lead the Exposure Management strategy, including Continuous Threat Exposure Management (CTEM) and risk-based prioritization of remediation activities.
Build an in-house portal that helps technology owners understand their exposures and prioritization requirements.
Drive automation initiatives to improve vulnerability identification, prioritization, tracking, and reporting efficiencies.
Provide strategic oversight of attack surface management and threat exposure analysis, and initiate risk remediation activities.
Integrate threat intelligence and adversary tactics, techniques, and procedures into exposure prioritization and remediation strategies.
Develop and implement risk-based methodologies to identify, assess, prioritize, and mitigate cyber exposures across on-premises, cloud, and hybrid environments.
Manage exposure-management escalations and ensure critical vulnerabilities and high-risk findings are addressed within defined service-level objectives.
Partner with IT, Security Operations, Infrastructure, Application Development, and business stakeholders to drive remediation and reduce organizational risk.
Hire, build, mentor, and lead a high-performing security team while managing vendor relationships and security technology investments.