Sr. Manager, Technology - Security

Williams-Sonoma•San Francisco, CA

5d•Onsite

About The Position

You will lead the Cyber Threat Intelligence (CTI) and Security Operations (SOC) functions within the Cyber Security organization. This team is responsible for monitoring, detecting, investigating, and responding to cyber threats while continuously improving the organization's detection and response capabilities. This role reports to the Director of Cybersecurity and is a critically strategic domain within the WSI Security Governance program. The CTI and SOC team's mission is to proactively defend the enterprise by leveraging intelligence-driven operations, detection engineering, incident response, and threat hunting to reduce cyber risk and enable secure business operations. As Manager, Cyber Threat Intelligence & Security Operations, you will lead a multidisciplinary team of Threat Intelligence Analysts, Detection Engineers, SOC Analysts, and Incident Responders. This is a hands-on technical leadership role where you will drive strategy, execution, and operations for this critical security domain while actively contributing to engineering and incident response efforts. This role offers the opportunity to shape the future of cyber defense across a globally recognized portfolio of retail brands by building modern detection, response, intelligence, and automation capabilities.

Requirements

7–10 years of progressive experience in Cyber Security with expertise in Security Operations, Threat Intelligence, Detection Engineering, and Incident Response.
Proven experience managing technical teams and comfortable rolling up sleeves and logging into consoles to verify configurations and adjust settings.
Demonstrated expertise across SIEM, SOAR, EDR, Threat Intelligence, endpoint security, penetration testing and incident response technologies.
Experience developing and reporting operational metrics including MTTD, MTTR, detection coverage, alert fidelity, incident trends, automation effectiveness, and threat intelligence impact.
Experience developing and executing a multi-year roadmap to mature the organization's SOC capabilities across people, process, technology, and automation.
Strong understanding of enterprise networking, cloud, identity, operating systems, and modern attack techniques.
Excellent communication, leadership, and cross-functional collaboration skills.

Nice To Haves

Hands-on experience with Google SecOps, CrowdStrike, Cortex XSOAR, MISP, and Tanium.
Experience building or maturing enterprise Detection Engineering and Threat Intelligence programs.
Capable of delivering automation and scripting (Python, PowerShell, etc.); agentic AI experience is an emerging plus.
Experience supporting regulatory investigations, governance, and compliance initiatives.
Strong familiarity with MITRE ATT&CK and intelligence-driven defense methodologies.

Responsibilities

Lead, mentor, and develop approximately 24 cybersecurity professionals across Threat Intelligence, Detection Engineering, Security Operations, Red Team, and Incident Response; think Player/Coach, someone coaching from experience gained from being a former individual contributor.
Define, execute, and continuously mature the enterprise Cyber Threat Intelligence, Detection Engineering, and Security Operations strategy aligned to business risk.
Lead the operation and continuous evolution of Google SecOps, CrowdStrike, Cortex XSOAR, MISP, Tanium, and supporting detection technologies.
Direct enterprise cyber incident response from initial triage through containment, eradication, recovery, executive communications, and lessons learned.
Drive proactive threat hunting, adversary tracking, IOC management, and intelligence collection and analysis.
Lead Detection Engineering including SIEM content development, use-case creation, alert tuning, and continuous improvements in detection quality.
Expand automation, orchestration and Ai-assisted capabilities to eliminate repetitive analyst work and accelerate investigation and response.
Develop intelligence-driven detections based on emerging threat actor tactics, techniques, and procedures (TTPs).
Lead Red Team operations including adversary emulation, penetration testing, purple team exercises, and validation of defensive controls and ensure Detection Engineering translates findings into improved detections and defensive capabilities.
Partner with Security Engineering, Identity & Access Management, Enterprise Security Architecture, Legal, Privacy, Fraud, and Information Technology teams to strengthen enterprise cyber defenses.
Provide hands-on support during major security incidents, investigations, platform integrations, and complex operational escalations.
Establish and maintain operational standards, playbooks, investigation procedures, and best practices.
Develop, track, and communicate key operational metrics and program maturity to executive leadership, driving continuous improvement through measurable outcomes.
Lead audit, governance, regulatory investigations, and executive cyber threat reporting.