Manager, Business Security Enablement

JOB DESCRIPTION

Manager, Business Security Enablement

Cybersecurity Technology and Operations

The Manager, Business Security Enablement reports to the Director, Cybersecurity Technology and Operations and leads the team that translates cybersecurity strategy, architecture and risk priorities into scalable, measurable security capabilities embedded in business and technology change. The Manager is accountable for the execution and sustained operation of the Business Security Enablement portfolio: security architecture; cloud, application and DevSecOps security; security controls engineering and implementation; security consulting; data loss prevention; and data encryption and cryptographic lifecycle capabilities.

This role turns the Cybersecurity Technology Strategic Roadmap into an integrated, outcome-based delivery plan. It leads a multidisciplinary team, partners across technology and business functions, and remains hands-on in architecture, delivery decisions, problem solving and technical escalation. The Manager establishes clear ownership, disciplined execution and practical operating models that are measurable, supportable, resilient and aligned to enterprise risk priorities.

Strategy, Roadmap and Portfolio Delivery

•  Translate the Director-approved cybersecurity strategy and 2027–2028 technology roadmap into prioritized workstreams, quarterly delivery plans, milestones, technical dependencies, measures, risks and sustained operating ownership.

•  Own execution and delivery of the Business Security Enablement roadmap, including control automation, detection and response enablement, risk-based remediation, cryptographic resilience, secure AI automation and reusable integration capabilities.

•  Establish a common delivery backlog, reusable integration patterns and transparent delivery cadence; standardize platforms and data flows before scaling automation.

•  Run weekly delivery and operational reviews, monthly KPI/KRI, platform-performance and risk reviews, and contribute to quarterly architecture, risk and investment-priority reviews.

•  Escalate material delivery blockers, architecture tradeoffs, control gaps, technical debt, resource constraints and residual risks to the Director with clear options and recommendations.

Business Security Enablement, Architecture and Engineering

•  Lead day-to-day delivery of security patterns, technical standards, reference architectures, design reviews and security consulting that build security into business and technology change.

•  Guide secure cloud, application, data and hybrid-technology designs; ensure appropriate threat modeling, secure configuration, protection requirements, implementation guidance and documented design decisions or exceptions.

•  Embed security into the software and service delivery lifecycle through DevSecOps practices, including secure coding guidance, SAST/DAST and dependency-security integration, CI/CD protections, policy-as-code, release evidence and remediation pathways.

•  Direct the engineering and implementation of resilient, measurable security controls, including configuration baselines, drift detection, control validation, compensating controls and auditable implementation evidence.

Automation, Integration, Control Assurance and Data Protection

•  Drive automation of control mapping, evidence collection and validation, control testing, assessments, workflow orchestration, KPI reporting and risk-informed remediation; support vendor and software assessments and policy/procedure lifecycle needs.

•  Lead secure AI-enabled workflows, services and integrations across security tools and technology platforms. Apply bounded autonomy, least privilege, approval gates, audit logging, testing and evaluation, monitoring, rollback/kill-switch capabilities, and clear human-accountability tiers.

•  Ensure AI automation and integration capabilities follow a documented control lifecycle from intake and design through build/test, deployment, monitoring and incident-learning evidence.

•  Advance data loss prevention and data-encryption controls, including technical delivery for automated key and certificate lifecycle capabilities, monitoring, exception handling, secure configurations and audit evidence.

•  Prioritize vulnerability, exposure and non-patch remediation using risk-based methods and coordinate compensating controls, validation and closure evidence with accountable technology owners.

SOC Engineering and Detection Enablement

•  Direct the SOC Engineer's delivery of telemetry and asset coverage, detection engineering, scanning/detection/reporting, investigation automation, IOC search, threat-hunting support, incident timelines and post-incident artifacts.

•  Improve the quality, reliability and adoption of security monitoring, alerting, investigation and workflow capabilities; ensure runbooks, escalation paths, operational health measures and sustainable support ownership are defined.

•  Coordinate security engineering enablement for GitHub monitoring and alerting, threat research, control-validation testing and approved adversary-testing activities in alignment with the broader security operating model.

People Leadership, Partnership and Assurance

•  Lead, coach and develop the Information Security Architect, Senior and Junior Security Controls Engineers, AI Automation and Integration Engineer, and SOC Engineer; establish goals, quality expectations, work priorities, performance feedback and succession/skills-development plans.

•  Create a high-accountability, collaborative culture that balances speed, security effectiveness, resilience, usability, cost and sustainable operations. Promote knowledge transfer, peer review, disciplined change management and continuous improvement.

•  Partner with application development, cloud/platform engineering, infrastructure, DevOps, enterprise architecture, data, risk, compliance, privacy, legal, audit and business teams to align delivery with enterprise priorities and control obligations.

•  Define and report outcome-based KPIs/KRIs, including roadmap progress, control coverage/effectiveness, evidence quality and timeliness, remediation aging/exposure reduction, detection coverage, automation value, service reliability and secure-delivery adoption.

•  Provide concise, risk-based updates and audit-ready evidence for leadership, governance forums, audits and regulatory examinations; support remediation of identified findings and validate closure.

•  Bachelor's degree in cybersecurity, information technology, computer science, engineering or a related field; equivalent relevant experience may be considered in accordance with organizational policy.

•   Five or more years of progressive experience in information security, technology engineering, operations or related IT disciplines, with demonstrated delivery across multiple relevant technical domains.

•  Two or more years of people management and/or technical team leadership, including hiring, coaching, performance management, work prioritization and delivery accountability.

•  Hands-on experience delivering security architecture, security engineering, cloud or application security, DevSecOps, control automation, security operations engineering or closely related capabilities in hybrid or cloud environments.

•  Demonstrated ability to translate strategy into executable roadmaps, manage cross-functional dependencies, make risk-informed technical decisions and sustain capabilities after implementation.

•  Working knowledge of security frameworks and control-evidence practices, including NIST and/or ISO-aligned approaches, audit support, risk treatment and regulatory/compliance expectations.

•  Strong written, verbal and executive communication skills, with the ability to explain technical risk, delivery tradeoffs, metrics and recommendations to technical and business audiences.

•  Master's degree in cybersecurity, information technology, business, engineering or a related discipline.

•  Relevant professional certifications such as CISSP, CISM, CCSP, CSSLP, cloud-security, security-architecture, DevSecOps, automation or AI-security credentials.

•  Experience with AWS and/or Azure; SIEM/SOAR/XDR, vulnerability or exposure management, DLP, encryption/key/certificate lifecycle capabilities, CI/CD and infrastructure-as-code, APIs, event-driven integration or workflow orchestration.

•  Demonstrates personal accountability, sound judgment and integrity; follows through from concept to sustained operational adoption.

•  Balances strategic leadership with practical technical depth, visible delivery ownership and thoughtful escalation.

•  Uses risk-based prioritization and transparent tradeoffs while maintaining disciplined security and control standards.

•  Builds trusted partnerships across Information Security, IT and business teams without bypassing governance or control accountability.

•  Promotes reusable, simplified and automated solutions that improve resilience, reduce friction and create durable operating value.

•  Develops technical talent, manages performance fairly and creates an environment of learning, collaboration and continuous improvement.