SummaryAt Simmons Bank, the Cybersecurity Manager is an essential leader within the Information Security team. The SOC provides continuous security monitoring and incident response; conducts security awareness and training; and manages security threats and vulnerabilities.
The Cybersecurity Manager oversees the activity of the SOC team, including hiring, training, and performance management. The Cybersecurity Manager also maintains strong operational programs; assesses escalated security events and threats; and develops, implements and tests incident response plans and playbooks.
Additional responsibilities include supporting the Bank's audits and examinations; supporting risk assessments related to the SOC; reporting the SOC's operational metrics, and reporting on SOC activities to IT and business leaders.
Essential Duties and ResponsibilitiesSecurity Operations- Develop and maintain the Security Operations Center (SOC) Program
- Direct a team of SOC analysts, delegating tasks as required to support daily cyber security detection and response activities
- Develop and maintain processes to enhance detection and response capabilities
- Develop use-cases and content for security event monitoring and automated workflows
- Monitor SOC analyst performance against defined SLAs and metrics
- Coordinate with Red Team and external service providers to scope and execute security assessments
Incident Response- Develop, implement, and test incident response plans with SOC, IT and business units
- Oversee the development of written SOC response playbooks
- Manage the incident response process serving as Incident Commander for declared cybersecurity incidents
- Manage an insider threat program, including data loss prevention
- Oversee SOC analysts' response to DLP alerts and escalations
- Serve as security liaison for Fraud and Compliance investigations
- Serve as quality control and security liaison for legal collections
Security Education- Oversee security awareness and training program, including content selection and development
- Oversee security awareness phishing simulations and tabletop exercises
- Provide guidance, education, and content to other departments and business units on cyber related matters as well as communicating capabilities of the SOC team
Threat and Vulnerability Management- Lead and manage the vulnerability management process
- Support application security scanning and vulnerability risk analysis
- Manage threat hunting and threat intelligence programs
- Manage program to protect digital assets from abuse and takedown process
- Oversee the analysis of vendor vulnerability releases (e.g. Patch Tuesday)
- Research new trends and advances in cybersecurity to stay updated on potential threats and best practices
- Advise business and technology leadership for potential changes in security posture
- Recommend and direct changes in automated tools supporting the monitoring and threat landscape
Administrative- Develop written standards for respective areas and contributes to the overall Information Security Policy and Program
- Responds to audit, compliance, and regulatory requests, as needed (e.g. SOX audit)
- Participate in periodic business reviews with vendors and internal customers
- Manage staffing, including supervision, scheduling, development, evaluation, and disciplinary actions
- Develop and maintain an environment of growth where knowledge and performance are consistently advancing
- Develop and mentor staff through open communication and training opportunities; build and maintain employee morale and motivation
QualificationsWork Experience- Five (5) years of experience in information security or cybersecurity
- Three (3) years of experience supervising and leading security operations personnel
- Banking or Financial Services experienced (preferred)
- Experience within Security Operations Center, Fusion Center, or MSP/MSSP (preferred)
- Experience with vulnerability management process, scanning tools, risk analysis and metrics reporting
- Experience investigating intrusions in a cloud/hybrid environment
- Experience with SIEM and/or log aggregation technologies, writing queries to support investigations and threat hunts
- Experience with security tool integrations (APIs) and automating processes with scripting and SOAR (preferred)
- Experience leading incident response activities at an appropriate level in prior roles
Education and Certifications- CISSP, CISM, GCIH, GSOC or other security related certifications (required)
- Multiple certifications across security disciplines (preferred)
- Bachelor's or Master's degree in a related field (preferred)
Other Qualifications (including physical requirements)
- Ability to balance multiple responsibilities and prioritize effectively
- Strong sense of urgency and focus on timely execution of deliverables
- Strong operational mindset and high degree of accountability
- Strong situational awareness and proactive, concise communicator
- Proficient with the MITRE attack framework and common threat vectors
- Proficient with security of Windows operating systems
- Strong oral and written communication skills
- Strong organizational, problem solving, and planning skills
- Must possess excellent telephone and customer service skills
- Must be willing to periodically work non-standard hours and be on call
Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Activities, duties and responsibilities may change at any time with or without notice.
