Principal, Cyber Security

Newell Brands•Atlanta, GA

About The Position

The Cyber Security Principal reports to the Senior Manager of Security Operations and serves as a senior technical leader within the Newell Brands information security program. This role is the primary Incident Commander for the Cyber Security Incident Response Plan (CSIRP) — owning end-to-end response coordination for high-severity and critical security incidents across Newell’s global environment. Beyond incident response, the Principal drives security engineering initiatives including control recommendations, detection engineering, and the design and implementation of automation across Security Operations workflows. The right candidate combines deep hands-on IR expertise with the engineering acumen to translate lessons learned into durable, scalable process improvements.

Requirements

10+ years of experience in cyber security required, with a minimum of 5 years in a dedicated Incident Response or Security Operations role.
Demonstrated experience serving as an Incident Commander or leading response efforts for high-severity incidents (ransomware, data breach, nation-state intrusion or equivalent).
Proven experience managing cross-functional response teams under pressure, including coordination with Legal, Communications and executive stakeholders.
Experience managing and directing external IR retainer engagements and third-party forensic vendors.
Hands-on expertise with endpoint and network-based forensic investigation, malware analysis and log-based intrusion analysis.
Practical security engineering experience: SIEM detection content development, SOAR playbook authoring and security automation scripting (Python, PowerShell or equivalent).
Demonstrated ability to provide security control recommendations and architecture guidance across endpoint, network, cloud (Azure, M365) and identity environments.
Strong knowledge of network protocols, OS internals and application-layer vulnerabilities, along with corresponding risk mitigations.
Prior experience in a Fortune 500 or complex global enterprise environment preferred.

Nice To Haves

GIAC Certified Incident Handler (GCIH)
BTL2 (Security Blue Team Level 2)
OffSec Defense Analyst (OSDA)
Certified Information Systems Security Professional (CISSP)

Responsibilities

Serve as primary Incident Commander in accordance with the Newell Brands CSIRP, leading response activities across all CSIRT functional teams for high-severity and critical incidents.
Make and communicate time-sensitive decisions to contain incidents, prevent escalation and restore normal operations as quickly and efficiently as possible.
Coordinate response activities across Security Operations, IT, Legal, HR, Corporate Communications, Privacy and other cross-functional teams, ensuring alignment with CSIRP priorities.
Partner with the CISO to brief executive leadership, the Information Security Governance Committee, and other key stakeholders on incident status, business impact and response actions.
Determine when to activate external IR retainer resources, manage those vendor relationships throughout an engagement, and ensure evidentiary integrity.
Lead post-incident reviews and after-action analysis; document findings and drive implementation of corrective actions to reduce recurrence.
Maintain and continuously improve CSIRP documentation, incident runbooks and playbooks; conduct tabletop exercises and simulation drills at least annually.
Develop and recommend security control improvements based on incident findings, threat intelligence and gap assessments across endpoint, network, identity and cloud environments.
Design, build and maintain detection engineering content — SIEM correlation rules, behavioral analytics and custom signatures — to improve fidelity and reduce mean time to detect.
Lead automation initiatives across Security Operations workflows including alert triage, enrichment, containment actions and case management integrations (SOAR/XSOAR or equivalent).
Evaluate emerging security technologies and make evidence-based recommendations for tooling investments that improve detection and response capabilities.
Collaborate with IT and infrastructure teams to validate that security controls are implemented correctly and test them through adversary simulation and purple team activities.
Provide senior-level oversight and mentorship to SOC analysts, elevating investigation quality and analyst skill development across the team.
Support Threat and Vulnerability Management, monitoring and alerting functions, ensuring operational coverage and response readiness across global time zones.
Maintain an in-depth understanding of Newell Brands’ current and forward-looking threat profile relevant to a global consumer goods company.
Own the development and maintenance of KPIs and metrics that demonstrate measurable improvement in Security Operations maturity and risk reduction.
Develop and maintain trusted relationships with stakeholders across IT, Legal, HR, Privacy, Ethics and business unit leadership.
Regularly engage the information security community to identify emerging threats, intelligence and techniques that may impact Newell Brands.