As a member of the IT Management Team, you are responsible for managing, developing, and leading a team of employees. Your role includes leading the specific functional responsibilities of your team, which involves overseeing team performance and deliverables. However, your role as a leader within our organization requires more than the management of resources and day-to-day operations. As a steward of the company, you are charged with the development and execution of your team's strategic vision and plan and ensuring that your team's actions align with the larger goals of the company and the IT Division.
This Security Engineering Manager is responsible for coordinating analysis, reviews, and other tasks necessary to protect the integrity and confidentiality of Costco Wholesale's information and information systems. This manager will provide strong leadership, direction, and guidance to Security personnel and IT Management on Information Security issues with a focus on cloud security. The three main areas of responsibility include, but are not limited to: managing the development of the cloud security program, aligning information security best practices with business requirements, and managing the Cloud Security team in alignment with corporate business objectives.
The Manager of Cloud Security Engineering will lead Costco's global Cloud Security program, focusing on the comprehensive development of our Cloud Security stack. This leadership role is responsible for enabling the discovery, monitoring, detection, and mitigation of internal and external security threats across all of Costco's cloud and code environments. Key objectives include driving the implementation, execution, metric tracking, and sustainability of program goals to ensure continuous improvement in our ability to protect Costco's global footprint and respond effectively to vulnerabilities and threats.
As the primary conduit between your employees and upper leadership, your role in communicating and modeling the values and guiding principles of our company culture is of vital importance. All members of IT Management should strive to consciously and consistently foster a culture of engagement, trust, and "open door" communication.
ROLE- INTEGRITY: When achieving benchmarks and goals, use methods/strategies that are consistent with the Code of Ethics and the Standard of Ethics for Managers and Supervisors. Always leads by example. Appropriately handles employee concerns and follows through to resolution.
- MEMBER SERVICE: Provides and ensures staff provides an exceptional member experience.
- ADMINISTRATION: Ensures proper department coverage (writing schedule and break aids if needed). Understands department budget, able to research and explain budget variances.
- MANAGING PERFORMANCE: Coaches and mentors' employees to provide support and guidance. Has regular open and honest conversations with employees to discuss work performance and career development. Identifies learning opportunities to strengthen employee knowledge, skill and ability.
- COMMUNICATION: Regularly shares information with employees via meetings and one-on-one conversations. Successfully navigates difficult conversations with employees, members, and suppliers. Listens, expresses empathy and adapts to get points across. Addresses issues immediately to ensure a timely resolution and to avoid escalating the situation. Consistently demonstrates business knowledge during interactions with senior management.
- SELF-MANAGEMENT: Demonstrates sound judgment, taking a partner when necessary. Ability to maintain self-control in the face of hostility or provocation or in intense, hectic situations.
- INCLUSION: Encourages different approaches and ideas to work and to accomplish goals. Seeks employee input. Takes the time to get to know or reach out to candidates who show potential that may not come forward on their own.
- COMPLIANCE AND SAFETY: Takes measures to ensure employee and member information is kept confidential and adheres to IS security policy.
- Translates business goals into security practices, policies, standards, guidelines, and procedures to support corporate information security.
- Monitors new and emerging security, compliance, and privacy related requirements, technologies, trends, issues, and solutions; and assesses their applicability to Costco Wholesale's key business initiatives and business strategies.
- Provides advice and consulting to senior management and the organization in the development, implementation, and administration of actions to meet these emerging requirements.
- Coordinates and monitors information security activities throughout the organization, including the preparation of periodic status and progress reports to applicable parties, leadership teams, and stakeholders.
- Hires, trains, and mentors Information Security team members.
- Responsible for thoroughly understanding and executing against outcome-based goals and strategy for this area, and supporting all IT divisional goals and initiatives.
- Establishes and develops a productive relationship between this area and other appropriate departments and outside vendors.
- Presents data supported fact-based, objective assessments of information security and compliance risks to management and acts on their direction for responding to such threats.
- Maintains an Information Security Business Plan that reflects the strategic direction within IT and provides annual and as-needed updates to management.
- Ensures that the team is properly staffed and trained to meet planned/approved objectives.
- Communicates and creates presentations, as required, to mid-level, upper-level management, and other personnel.
- Leads the team in developing and driving KPI's and metrics.
- This is a full-time management/leadership position (45+ hours per week).
REQUIRED- Experience managing and knowledge of securing code to cloud with Cloud Native Application Protection Platform (CNAPP) solutions.
- Experience working with various cloud providers including Azure, GCP, AWS, and OCI.
- High level technical understanding of cloud technologies including IaaS, PaaS, SaaS, and containers.
- Ability to define, communicate, and execute on a vision and strategy.
- Conversant in technology matters related to security, architecture, emerging InfoSec trends, compliance, and risk.
- Strong knowledge of cloud security policy and how to use security tooling to automatically identify violations.
- Demonstrates the ability to drive proactive enforcement and remediation of cloud security vulnerabilities, misconfigurations, and policy violations.
- Knowledge of managing and coordinating cloud security stacks across multiple cloud or on premises environments.
- Demonstrates ability to manage and direct deployment of security tools and technologies.
- A deep understanding of cybersecurity threats, vulnerabilities, controls, and remediation strategies in global enterprise environments.
- Ability to effectively communicate the need for security tooling and technologies to all levels of the organization.
- Excellent communication skills, both oral and written, that can communicate security and compliance issues to executives, end users, and security experts in an effective and appropriate manner.
- Outstanding customer/client relations skills to ensure that security and business objectives are always in alignment; a flexible and business-oriented focus on security matters.
- Extremely responsive, with a strong sense of urgency.
- Able to work well under stress and handle crisis situations professionally.
- Scheduling flexibility to meet the needs of the business including evenings, weekends, holidays, and 24/7 on call responsibilities on a rotational basis.
- HIPAA Training and Supervisors Orientation (within 30 days of hire); Leadership Development 101 (within one year); Costco Pay Policies (within 90 days of promotion).
Recommended- Bachelor's degree in an Information Systems related field.
- Experience leading Information Security or Compliance teams.
- Strong understanding of Continuous Integration/Continuous Delivery (CI/CD) pipelines.
- Understands infrastructure as code (IaC) including development using technologies such as Terraform.
- Experience managing budgets ($5M+) over the course of Months, Quarters, and Years.
- Understanding of Zero Trust principles.
- Strong organizational skills with ability to handle multiple high visibility issues simultaneously.
- Ability to communicate complex and technical issues to diverse audiences, verbally and in writing, in an easily-understood, authoritative, and actionable manner.
- Previous management experience over highly technical teams.
- Hands-on experience related to security design, architecture, incident response, and strategic planning.
- Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM).
- Possess experience with common information security management frameworks, such as International Standards Organization (ISO) /27001, the IT Infrastructure Library (ITIL), and Control Objectives for Information and Related Technology (COBIT) frameworks.
Required Documents• Cover Letter
• Resume
• Last two performance reviews
• Attendance records for current year (Do not include absences covered by paid sick/personal time,
FMLA or other protected absences.)
Pay Range: $137,000 - $210,000, Bonus and Restricted Stock Unit (RSU) eligible
We offer a comprehensive package of benefits including paid time off, health benefits - medical/dental/vision/hearing aid/pharmacy/behavioral health/employee assistance, health care reimbursement account, dependent care assistance plan, short-term disability and long-term disability insurance, AD&D insurance, life insurance, 401(k), stock purchase plan to eligible employees.
