Senior Manager, Security - Detection & Incident Response

Kraft Heinz•Chicago, IL

About The Position

The Senior Manager, Security - Detection & Incident Response leads the security incident detection and response lifecycle and manages the changing threat landscape through effective use of resources, threat intelligence, and training to mitigate the impact of global incidents. The role leads the MSSP Security Operations Center and oversees detection and incident response initiatives across people, processes, and technology. The position develops and maintains strategic roadmaps, incident response plans and playbooks, testing and training, and measures such as KPIs and KRIs. It investigates and analyzes security incidents and computer-based evidence, recommends and coordinates remediation, and works with architecture, development, and engineering teams to address recurring incident root causes. The role also drives continuous improvement, tool tuning, process improvement, communication, and relationships with business areas and vendor partners.

Requirements

7+ years of relevant information security experience.
Ability to translate technical incidents into business terms.
Experience creating and presenting technical strategies and technical solution recommendations.
Thorough understanding of Security Operations Center, Incident Response, Threat Hunting, and enterprise digital forensics concepts, including investigation techniques, acquisition, chain of custody, preservation of evidence, validation, and sterilization.
Experience developing automated case management systems.
Hands-on experience developing incident response programs with Legal and the Chief Privacy Officer.
Experience working in, leading, or fostering an agile environment for effective and efficient collaboration.
Experience operating as an incident controller and performing timely escalations.

Nice To Haves

Scripting experience.

Responsibilities

Lead and manage the MSSP Security Operations Center, ensuring timely identification, analysis, containment, and remediation of global security events and incidents.
Create, implement, and maintain a strategic roadmap in collaboration with security leadership, including creating and maintaining KPIs and KRIs.
Analyze cyber incidents and remediate or recommend remediation in accordance with established incident response processes, including detection, triage, containment, incident analysis, remediation, and reporting.
Conduct technical examinations, analysis, and reporting of computer-based evidence related to security incidents and investigations.
Develop and maintain incident response plans, playbooks, testing, and training for internal and external team members.
Recommend tuning of security tools based on threat feeds, reputation data, events, vulnerabilities, and exploits of downstream systems.
Recommend ways to resolve or reduce the impact of incidents and prevent future incidents.
Collaborate with architecture, development, and engineering teams to identify root causes of recurring incidents and create resolution action plans.
Drive continuous improvement and program management for detection and incident response initiatives across people, process, and technology, including training, communication, and relationship management with business areas and vendor partners.
Identify and recommend opportunities for clean-slate process improvement in incident management.

Benefits

Medical, prescription drug, dental, and vision coverage.
7% 401(k) matching.
Performance-based bonus.
Paid time off and company holidays.
Flexible work arrangements.
Employee Assistance Program and wellbeing programs.
Family support programs.
Life insurance, accidental death and dismemberment coverage, and disability coverage.
Business Resource Groups supporting diversity, inclusion, and belonging.
Training and learning opportunities.
Benefits begin immediately upon hire for salaried employees.