Sr. Manager, Security Services

Panera Bread•Saint Louis, LA

19d•$145,305 - $186,572

About The Position

The Sr. Manager, Security Services leads cybersecurity operations, maintains operational compliance, and improves the effectiveness of security controls and services. The role oversees security monitoring, incident response, vulnerability and exposure management, Data Loss Prevention, threat intelligence, security awareness, assigned security platforms, and third-party security providers. It combines hands-on operational accountability with team and program leadership, including practical application of PCI DSS, audit readiness, control validation, risk management, privacy-related security obligations, and evidence requirements. The position provides operational governance for Managed Detection and Response and outsourced Security Operations Center services. It holds internal teams and external providers accountable through defined responsibilities, escalation paths, service expectations, performance metrics, runbooks, and documented processes. The role owns the operation and oversight of assigned security controls, products, and services, including their operational requirements, performance, documentation, and continuous improvement. It provides security governance and consultation but is not the organization’s Enterprise Architecture, Security Engineering, or Platform Engineering design authority. It partners with GRC, Legal, Privacy, Internal Audit, Procurement, and technology teams on regulatory interpretation, policy, audits, contracts, risk decisions, secure development and build practices, patching, and technical implementation.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Risk Management, or a related discipline, or equivalent practical experience.
Seven or more years of progressive cybersecurity experience, including substantial responsibility in security operations and demonstrated experience in vulnerability management, risk management, compliance, or related disciplines.
At least three years of experience leading cybersecurity teams and programs, including responsibility for staff development, operational priorities, major initiatives, or cross-functional security activities.
Demonstrated experience with incident response, vulnerability management, threat analysis, application security risks, endpoint security, server and network security, cloud security, Data Loss Prevention, threat intelligence, security monitoring, remediation practices, and data protection.
Experience overseeing MDR, outsourced SOC, managed security services, or comparable third-party cybersecurity providers.
Working knowledge of PCI DSS, SOX-related security considerations, privacy and personal-information protection, audit readiness, control validation, risk assessment, remediation tracking, and evidence management.
Experience translating regulatory, contractual, policy, and control requirements into sustainable operational security processes.
Experience serving as the operational owner of enterprise security platforms and managing security vendor and service-provider relationships, including licensing, renewals, and service reviews.
Excellent oral and written communication skills, with the ability to communicate security, risk, and compliance matters to executives, end users, technical teams, auditors, and external providers.
Strong leadership, judgment, analytical, organizational, and stakeholder-management skills, with the ability to manage competing operational priorities and incidents.

Nice To Haves

Experience supporting PCI DSS assessments and Approved Scanning Vendor requirements.
Experience with AI governance, emerging-technology risk reviews, privacy, or data-protection programs.
Hands-on experience with security technologies such as Zero Trust, secure web gateway, endpoint protection, vulnerability scanning, and security workflow automation.
Familiarity with NIST CSF, NIST 800-53, CIS Controls, ISO 27001, SOC 2, and technical security risk-assessment methodologies.
Experience preparing executive, audit committee, or board-level security reporting.
Relevant certification such as CISSP, CISM, CRISC, CISA, GIAC, PCI ISA, or an equivalent credential.

Responsibilities

Lead day-to-day Security Operations, including monitoring, proactive threat detection, investigation, incident response, escalation, containment, recovery, and post-incident improvement.
Develop, maintain, and periodically test incident-response runbooks, investigation procedures, escalation workflows, and operational playbooks for internal teams and third-party providers.
Oversee third-party security service providers, including MDR and outsourced SOC services; monitor service quality, alert effectiveness, escalation performance, investigation outcomes, and corrective actions.
Own and mature vulnerability and exposure management, including scanning, risk-based prioritization, remediation coordination, exception management, validation, and reporting.
Serve as the operational owner and subject matter expert for assigned security platforms and services; define requirements, establish capability roadmaps, coordinate enhancements, and improve automation, visibility, utilization, and measurable risk reduction.
Oversee administration, support, documentation, monitoring, lifecycle management, and performance of assigned security platforms, ensuring reliable operation and alignment with approved security and compliance requirements.
Lead operational DLP processes, including monitoring, investigation, severity classification, escalation, notification, exception handling, remediation, and reporting.
Oversee threat intelligence and digital-risk-protection activities involving compromised credentials, impersonation, fraudulent domains, dark-web exposure, brand abuse, active threats, and other external risks.
Lead Information Security participation in AI use-case reviews, evaluate risks related to data handling, access, vendors, integrations, model training, retention, processing locations, and technical controls, and document safeguards or risk-treatment actions.
Provide security consultation, governance, and risk guidance for enterprise projects, technology initiatives, business programs, and vendor implementations; recommend controls, compensating controls, and mitigation strategies.
Ensure operational security controls support PCI DSS, SOX-related security considerations, audit, contractual, policy, privacy, and other applicable compliance requirements.
Coordinate audit and compliance evidence, validate control operation, and drive corrective actions from audits, security assessments, control deficiencies, penetration tests, vulnerability assessments, and compliance reviews through closure.
Develop and maintain operational dashboards and report on incidents, vulnerabilities, active threats, DLP activity, remediation progress, compliance readiness, third-party SOC performance, and overall security posture.
Support and enhance security awareness campaigns, phishing simulations, security communications, user education, and compliance-related training, including annual PCI security awareness requirements.
Manage commercial and lifecycle aspects of security vendor and service-provider relationships, including service reviews, technical escalations, licensing, renewals, performance improvement, and lifecycle planning, in partnership with Procurement.
Lead, coach, and develop security professionals while strengthening documentation, cross-training, accountability, and operational resilience.
Partner with Security Engineering, Platform Engineering, Infrastructure, Cloud, Network, Endpoint, Application, Enterprise Architecture, Legal, Privacy, Internal Audit, GRC, Procurement, Human Resources, and business stakeholders to implement controls, coordinate remediation, and resolve security and compliance risks.