Senior Manager, Cybersecurity, AI SOC – Crisis Management

This is a fully remote position, open to applicants in Michigan.

📋 Description

• Lead global CIRT operations, ensuring follow-the-sun coverage, escalation, containment, recovery, closure, and continuity during outages.

• Supervise managed detection and response providers, focusing on readiness, governance, performance, escalation quality, budgets, licensing, and commitments.

• Enhance responsible AI-assisted triage, investigation, decision support, documentation, and response with appropriate oversight, approvals, auditability, and reversibility.

• Manage the Cyber Defense digital twin roadmap and operationalize capabilities by defining use cases, requirements, success measures, acceptance, adoption, and legacy retirement.

• Direct incident response efforts, govern non-destructive containment and automated actions, and engage Investigations, Threat Hunting & Forensics when necessary.

• Track response times, escalation and case quality, automation effectiveness, queue health, service levels, and implement corrective actions.

• Oversee the detection content lifecycle with Detection Engineering, including rule development, tuning, coverage mapping, and deprecation.

• Collaborate with Cyber Threat Intelligence, Threat Exposure Management, Vulnerability Management, Security Engineering, and Enterprise Technology to enhance response efforts.

• Manage cyber crisis situations and CIRT activation, including severity criteria, escalation thresholds, leadership notifications, governance, and operational coordination.

• Conduct executive briefings, stakeholder updates, reporting, maintain communication cadence, and document significant decisions.

• Facilitate coordinated responses involving crisis, communications, legal, privacy, human resources, procurement, continuity, and technology operations teams.

• Lead executive tabletop, functional, and technical exercises; maintain the roadmap and ensure corrective actions are addressed.

• Conduct post-incident reviews and integrate technical findings and root-cause lessons into playbooks and readiness activities.

• Develop CIRT leadership through coaching, exercises, structured development, and clear performance expectations.

• Apply incident response, recovery, crisis communications, business continuity, and crisis coordination practices during high-pressure events.

• Convert issues into business terms and coordinate concurrent workstreams using risk-based decision-making.

• Incorporate FDA, HIPAA, SEC cyber disclosure, sanctions compliance, and other reporting considerations into response processes.

• Address threats involving contractors and contingent workers through identity verification and access revocation coordination.

⛳️ Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, Business, or a related field.

• At least 10 years of experience in cybersecurity operations, incident response, crisis management, technology operations, or enterprise service delivery.

• A minimum of 5 years of leadership experience managing technical teams, global operations, strategic initiatives, or managed services.

• Proven experience leading significant cybersecurity incidents while collaborating with technical, business, legal, communications, and executive stakeholders.

• Background in managing a Security Operations Center, CIRT, Managed Detection and Response service, or a comparable operational capability.

• Experience in implementing or governing AI-enabled workflows, automation, orchestration, or technology-driven operational transformation.

• Preferred: Master's degree in Cybersecurity, Business Administration, Technology Management, or a related discipline.

• Preferred: Professional certifications such as CISSP, CISM, GCIH, ITIL, PMP, or equivalent.

• Willingness to participate in after-hours or on-call incident response and crisis management activities as needed.

🏝️ Benefits

• Flexibility for remote work.

• No travel required (Travel Percentage: None).