Manager, Information Security - Application Security

O'Reilly Auto Parts • Headquarters, KY

1d • Onsite

About The Position

The Information Security Manager- Application Security will manage and maintain the organization's cybersecurity systems and infrastructure and protect the organization's IT systems and computer networks against cyberattacks, intrusions, malware, and various types of data breaches. They oversee secure development practices, vulnerability assessments (scanning/penetration testing), and ensure compliance. This is an on site position located in Springfield, MO.

Requirements

• Proven experience in application security, penetration testing, or software development.
• Understanding of web application vulnerabilities (e.g. OWASP Top 10), secure coding principles, and CI/CD tools.
• Strong team management and communication skills.
• Knowledge/Experience with: Static (SAST) and Dynamic (DAST) analysis tools, Web Application Firewalls (WAF), Risk Management frameworks
• Applies comprehensive knowledge / skill, acts with independence and provides guidance and training to others
• Implements transaction security and computer/network virus protection.
• Maintains systems/services and information security, integrity, compliance and continuity.
• Ensures the confidentiality, integrity, and availability of information.
• Controls access to servers, systems, and computers.
• Follows confidentiality procedures, ensuring that restricted information is only shared with approved recipients, that data sharing is done so using approved/secure communication methods, and that data is kept safe and secure at all times.
• Interprets and applies knowledge of laws, regulations and policies in area of expertise.
• Monitors, interprets and understands policies and procedures and ensure their alignment with organizational strategies and work objectives.
• Conducts gap analysis between current and future states to identify components of the overall change strategy.
• Plans, organizes, prioritizes and oversees activities to efficiently meet objectives.
• Determines and analyzes trends from data that is collected to assist in compiling reports that will help in decision-making.
• Acquires, organizes, protects and processes data in order to fulfill business objectives.
• Substantial general work experience together with comprehensive job-related experience in own area of expertise to fully competent level. (6 to 10 years)
• Experience of planning and managing resources to deliver predetermined objectives as specified by more senior managers (3 to 6 years)

Nice To Haves

• Plans and manages small project work assignments within desired cost, time and quality parameters.
• Identifies, sequences, and resources project schedules for timely completion.
• Estimates and manages the effort and finances to complete the work within budget.
• Demonstrates a change mindset as well as plans, executes and monitors activities during times of change whilst keeping performance levels up.
• Identifies, addresses, and navigates opposition or reluctance effectively, fostering a collaborative environment and facilitating positive outcomes in the face of resistance.
• Creates reports, and reviews reports created by others, for various audiences as relevant, in a lucid and effective manner, keeping in mind the purpose of reports.
• Communicate and articulates potential resolutions or strategies in a clear, compelling, and tailored manner to address specific challenges or meet organizational needs.
• Understands and effectively uses standard office equipment and standard software packages to support business processes.
• Expresses ideas, requests action, formulates plans, & policies by means of clear and effective verbal communications.
• Ability to change actions or plans at short notice.
• Understands, evaluates, uses, and engages with digital technology and information, as well as create and share digital content, while being aware of essentials like safety, privacy and ethical considerations.
• Shifts into and out of a mental mindset associated with assessing the facts and circumstances of the current situation and/or environment, and makes the appropriate/innovative adjustments to thinking and work habits to thrive in any scenario.

Responsibilities

• Security Strategy: Develop and implement security policies and procedures for the full software development life cycle (SDLC).
• Vulnerability Management: Oversee vulnerability assessments, code scanning, and penetration testing, prioritizing findings for remediation.
• Team Leadership: Supervise, train, and manage security personnel or AppSec engineers.
• Threat Modeling & Risk Analysis: Perform, manage, and deliver risk assessments for applications.
• Guidance & Collaboration: Act as a liaison between development teams and security, providing guidance on best practices for secure coding.
• Incident Response: Investigate security incidents and provide timely resolutions.
• Reporting & Metrics: Produce key performance indicators (KPIs) and reports on the security posture.
• Lead in detecting and analyzing security incidents, including attacks, breaches, and identified vulnerabilities, and remediate any security gaps in line with the security incident management procedure.
• Explore and develop a detailed understanding of external developments or emerging issues and evaluate their potential impact on, or usefulness to, the organization.
• Document complex "as is" and "to be" processes and describe the changes required to migrate to the "to be" capability to record accurately the change required.
• Provide input and assist GRC with the drafting of policies, procedures, and related guidelines within an area of expertise to meet defined key principles and ensure compliance with external requirements.
• Monitor and review performance and behaviors within area of responsibility to identify and resolve noncompliance with the organization's policies and relevant regulatory codes and codes of conduct.
• Elicit complex business requirements using a variety of methods, such as interviews, document analysis, workshops, and workflow analysis, to express the requirements in terms of target user roles and goals.
• Communicate the actions needed to implement the function's strategy and business plan within the team; explain the relationship to the broader organization's mission, vision, and values; motivate Team Members to commit to these and to do extraordinary things to achieve local business goals.
• Support strategy formulation for digital by exploring how information technology can be used to help the organization become more responsive to customer needs and changing business requirements.
• Manage and report on the performance of a substantial, diverse team; set appropriate performance objectives for direct reports or project/account team members and hold individuals accountable for achieving them; take appropriate corrective action where necessary to ensure the achievement of team/personal objectives.
• Develop and/or deliver budget plans with guidance from senior colleagues.
• Use the organization's formal development framework to identify the team's individual development needs. Plan and implement actions, including continuing professional development specified by professional or regulatory institutions, to build their professional capabilities.
• Provide informal training or coaching to others throughout the organization in own area of expertise to enable others to improve performance and fulfill personal potential.
• Develop stakeholder engagement by identifying stakeholders; by finding out their needs, issues, and concerns; and by reacting to these needs, issues, and concerns to support the communication of business information and decisions.
• Conduct research and select relevant information to enable analysis of key themes and trends using primary data sources and business intelligence tools.
• Manage a portfolio of projects while reporting to senior colleagues.
• Develop medium- or long-term work schedules that enable the organization to achieve its business goals. Involves coordinating across multiple teams.

Benefits

• Competitive Wages & Paid Time Off
• Stock Purchase Plan & 401k with Employer Contributions Starting Day One
• Medical, Dental, & Vision Insurance with Optional Flexible Spending Account (FSA)
• Team Member Health/Wellbeing Programs
• Tuition Educational Assistance Programs
• Opportunities for Career Growth

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Number of Employees: 5,001-10,000 employees