Description
• The Security Operations Manager is responsible for overseeing the day-to-day security operations, monitoring, and incident response protocols across the Dallas ISD digital environment. The ideal candidate is expected to be an experienced leader with a deep understanding of threat detection and response, capable of coordinating both internal staff and external vendors. Additionally, this person will be expected to ensure the continued safety of district staff, students, and data by staying current with emerging cyber threats and best practices for educational data privacy.
• Operational Oversight: Direct the daily activities of the Security Operations Center (SOC) to ensure continuous monitoring of the district's network, data center, and cloud environments.
• Incident Management: Serve as the primary lead for all cybersecurity incidents, managing the full lifecycle from detection to post-event retrospective and long-term remediation.
• Emergency Preparedness: Lead the annual review and revisions of the district's cyber incident response plan and supporting runbooks. Facilitate quarterly tabletop exercises to sharpen the district's incident response readiness.
• Technology Platform Management: Maintain and improve the deployment of the district's cyber operations platforms (including SIEM, SOAR, and EDR). Develop and lead a proactive threat-hunting program that utilizes internal telemetry and external threat intelligence to identify and mitigate sophisticated adversaries before they trigger standard alerts.
• Vendor & Staff Management: Supervise and mentor internal security analysts and manage relationships with third-party security vendors to ensure contractual SLAs and performance standards are met.
• Cross-Functional Collaboration: Work closely with other IT teams and district leadership to align security initiatives with educational goals and infrastructure upgrades. Represent the district in continuous collaboration with other strategic partners across the K-12 and Public Sector ecosystem.
• Executive Reporting: Brief senior management and key stakeholders on the cyber incident response program. Define, track, and report on key performance indicators (KPIs) such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Contain (MTTC).
Qualifications
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field plus minimum of six years of experience in IT Security, with at least two years in a supervisory or management capacity
• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) or GIAC Certified Incident Handler (GCIH) strongly preferred.
• Technical Proficiency: Strong working knowledge of SIEM/SOAR platforms, EDR/device security solutions, and network security concepts. Familiarity with other cyber domains (data, identity, application, third party risk).
• Process Proficiency: Strong working knowledge of creating, documenting, and automating repeated processes to quickly respond to alerts from cybersecurity platforms.
• Communication: Exceptional interpersonal and verbal communication skills, with the ability to translate complex technical risks into actionable insights for non-technical stakeholders.
• Leadership: Proven ability to lead high-pressure teams during active security incidents while maintaining a calm, decisive presence.
