Manager of Security Operations

Polsinelli•Washington, DC

About The Position

The Manager of Security Operations leads and manages day-to-day cybersecurity operations, including threat detection, incident response, data loss prevention, vulnerability management, email security, and securing enterprise applications. The role provides operational leadership for security monitoring, investigation, and response, ensuring threats and vulnerabilities are identified, assessed, prioritized, and remediated in a timely manner. The Manager serves as the primary incident commander during significant cybersecurity incidents, coordinating technical response activities and cross-functional resources to minimize business disruption and organizational risk. The position combines technical cybersecurity expertise, operational discipline, leadership, and risk-based decision-making to protect information assets, technology infrastructure, and sensitive data. Success includes maintaining effective security operations, improving threat detection and response, reducing exposure to known vulnerabilities, preventing unauthorized disclosure, and measurably improving security readiness and operational maturity. The role requires availability to provide leadership and incident-command support during significant cybersecurity incidents outside normal business hours when necessary. It also requires sound judgment and strict confidentiality when handling sensitive organizational information, security investigations, and incident-related evidence, as well as maintaining current knowledge of emerging threats, cybersecurity technologies, and industry best practices.

Requirements

Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field, or equivalent professional experience.
Minimum of 5 years of progressive experience in cybersecurity or information security, including substantial hands-on experience in security operations, incident response, and vulnerability management.
Demonstrated experience managing significant cybersecurity incidents and coordinating cross-functional incident-response activities.
Working knowledge of enterprise security architectures, endpoint protection, identity security, network security, cloud security, and security-monitoring technologies.
Experience developing security procedures, incident-response playbooks, operational metrics, and management reporting.
Strong understanding of incident-response methodologies, digital forensics principles, and cybersecurity investigation techniques.
Experience with SIEM, EDR/XDR, DLP, vulnerability scanning, email security, and ITSM platforms.
Knowledge of common attack techniques, including ransomware operations, phishing, credential compromise, lateral movement, and data exfiltration.
Understanding of vulnerability scoring and prioritization methodologies, including CVSS, CISA Known Exploited Vulnerabilities (KEV), and exploit intelligence.
Familiarity with MITRE ATT&CK, NIST SP 800-61, the NIST Cybersecurity Framework, and CIS Controls.
Strong analytical, investigative, troubleshooting, and problem-solving skills.
Ability to lead high-pressure cybersecurity incidents, make timely risk-based decisions, and coordinate technical and business stakeholders.
Ability to exercise sound judgment and maintain strict confidentiality with sensitive organizational information and incident evidence.

Nice To Haves

Experience managing security operations within professional services, legal, financial services, healthcare, or another highly regulated environment.
Experience working with managed security service providers, MDR partners, incident-response retainers, and external penetration-testing firms.
Experience developing or maturing a Security Operations Center (SOC) or security operations program.
Familiarity with Microsoft 365, Azure, hybrid infrastructure, and cloud security monitoring.
Experience integrating security operations processes with enterprise risk management and business continuity programs.
Experience implementing security automation and orchestration capabilities, including SOAR platforms.
Experience managing operational budgets, security vendors, and security technology roadmaps.
Preferred certifications: CISSP, CISM, GIAC Certified Incident Handler (GCIH), CompTIA CySA+, or an equivalent technical certification.

Responsibilities

Lead and manage day-to-day cybersecurity operations, including threat detection, incident response, data loss prevention, vulnerability management, email security, and enterprise application security.
Provide operational leadership for security monitoring, investigation, and response capabilities.
Ensure security threats and vulnerabilities are identified, assessed, prioritized, and remediated in a timely manner.
Serve as primary incident commander during significant cybersecurity incidents.
Coordinate technical incident-response activities and cross-functional resources to minimize business disruption and organizational risk.
Develop security procedures, incident-response playbooks, operational metrics, and management reporting.
Manage competing security priorities, allocate resources, establish accountability, and maintain operational effectiveness.
Prioritize security activities based on threat exposure, business impact, and organizational risk tolerance.
Communicate clear, concise, and actionable information to technical teams, business stakeholders, and executive leadership.
Establish repeatable operational processes, improve security capabilities, and measure program effectiveness.
Coordinate with technical teams, business units, leadership, and external service providers.
Provide incident-command support outside normal business hours when necessary.
Maintain confidentiality when handling sensitive information, investigations, and incident-related evidence.
Maintain current knowledge of emerging threats, evolving cybersecurity technologies, and industry best practices.