Senior Cybersecurity Manager

• We achieve together by championing a team-oriented workplace built on mutual respect, collaboration, and open communication.  
• We encourage individuals and teams to constantly be curious and seek a deeper understanding and fresh ideas that drive innovation and meaningful change
• We provide a supportive workplace where you can elevate yourself and achieve personal growth through continuous learning, focused effort, and perseverance
• We deliver value as part of every action we take to serve California’s citizens

• Drive enterprise security strategy across security engineering, SecOps, and compliance domains
• Design and oversee security architecture for cloud-native and hybrid environments
• Champion shift-left security practices including secure coding, threat modeling, and DevSecOps
• Make critical trade-off decisions balancing security controls, operational efficiency, and delivery timelines

• Own security metrics and ROI for security investments across tools, people, and processes
• Develop cost-benefit analyses for security controls, tooling decisions, and compliance initiatives
• Manage team budget including security tools, penetration testing, audits, and infrastructure
• Translate security improvements into business value through reduced incidents and compliance costs
• Drive efficiency improvements in security operations while maintaining comprehensive protection

• Manage, mentor, and develop a team of 10-20 security engineers across multiple disciplines
• Conduct regular 1:1s focused on career development and performance
• Execute performance management including promotions, improvement plans, and difficult conversations
• Build diverse, inclusive teams through thoughtful hiring and team composition

• Establish and maintain security operations capabilities and incident response procedures
• Lead incident response efforts for critical security events and coordinate cross-functional response
• Implement security monitoring, SIEM management, and threat intelligence programs
• Drive continuous improvement in mean time to detect (MTTD) and mean time to respond (MTTR)

• Ensure adherence to HIPAA, StateRAMP, NIST, and other regulatory frameworks
• Manage security audit processes and remediation efforts across multiple compliance standards
• Develop and maintain security policies, standards, and procedures
• Conduct risk assessments and manage enterprise risk register

• Oversee application security including SAST, DAST, and software composition analysis
• Manage penetration testing programs including scope, vendor management, and remediation
• Implement infrastructure security controls for cloud and on-premise environments
• Drive automation of security controls and integration into CI/CD pipelines

      Outcome: Comprehensive security testing coverage with vulnerabilities identified and remediated early

• Partner with Engineering on secure development practices and security requirements
• Collaborate with Infrastructure teams on cloud security and zero-trust architecture
• Work with Legal and Compliance on regulatory requirements and audit responses
• Communicate security risks and metrics to executive stakeholders and board members

      Outcome: Security embedded throughout the organization with strong stakeholder alignment

• Lead technical interviews and hiring decisions for security roles across multiple disciplines
• Develop team skills through training, certifications (CISSP, OSCP, AWS Security)
• Identify and cultivate future security leaders and architects
• Build team culture emphasizing proactive security and continuous improvement

      Outcome: Strong talent pipeline with security professionals growing into senior and leadership roles
​​​​​​​

• Proven track record managing security teams of 15+ members across multiple disciplines
• Experience owning P&L or budget responsibility for enterprise security programs
• Demonstrated ability to connect security initiatives to business outcomes and risk reduction
• Experience building and operating security programs including SecOps, compliance, and engineering
• Strong background in cloud security, DevSecOps, and modern security practices
• Experience managing compliance for regulated environments (HIPAA, FedRAMP, SOC2)
• Track record of reducing security incidents and improving security posture metrics
• Bachelor's degree in Computer Science, Information Security, or equivalent experience

Technical

• Cloud Security: AWS/Azure/GCP security services, IAM, network security
• Security Tools: SIEM (Splunk/Datadog), SAST/DAST (Snyk), EDR (CrowdStrike)
• Infrastructure Security: Zero-trust architecture, microsegmentation, Kubernetes security
• Compliance Frameworks: HIPAA, NIST CSF, StateRAMP, SOC2, ISO 27001
• Penetration Testing: OWASP, threat modeling, vulnerability management
• Languages: Python, Bash, Terraform, understanding of multiple programming languages

Business & Financial

• Financial Management: Security budget ownership, tool optimization, and ROI analysis
• Risk Management: Risk assessment, risk register management, and business impact analysis
• Security Metrics: MTTD, MTTR, vulnerability closure rates, compliance scores
• Value Communication: Articulating security investments in business risk terms
• Vendor Management: Managing MSSPs, penetration testing firms, and security tools

Leadership

• People Management: Performance management, career development, and 24/7 team coordination
• Team Building: Hiring across security disciplines, onboarding, and culture development
• Communication: Board-level reporting, incident communication, and technical translation
• Decision Making: Risk-based security decisions and incident response leadership
• Strategic Thinking: Aligning security strategy with business objectives
• Change Management: Leading security transformation and tool migrations

General

• Problem-Solving: Complex security incident and architectural challenge resolution
• Collaboration: Working effectively with Engineering, Legal, Compliance, and Executive teams
• Mentorship: Developing security professionals across multiple specializations
• Process Improvement: Implementing security automation and operational efficiency
• Crisis Management: Leading through security incidents and maintaining composure under pressure