The Manager, Security Operations will be a hands-on Security Operations and Incident Response leader to lead and grow our security operations, incident response and compliance reporting team. This role requires prior experience with leading and growing a security operations center, delivering managed security services, and supporting incident response activities particularly in compliance with HIPAA, PCI DSS and HITECH requirements.

Job Relationships

Reports to the Director, Security & Network Engineering

Principal Responsibilities

• Responsible for the delivery of security and compliance services that include technical understanding of SIEM, SOAR, EDR, firewalls, network, and email security tools with a variety of enterprise IT and cloud-based architectures and technologies.
• Provide leadership and guidance, acting as the main contact for Springfield Clinic users and senior management as the 24/7 senior focal point for security operations, incident management and compliance reporting services.
• Oversee the continuous monitoring program including identification, intake, triage, response, remediation, and resolution of issues related to providing security operations, and incident response while prioritizing incidents based on risk or exposure.
• Manage and develop team of Identity and Access analysts and security operations analysts including performance reviews, utilization tracking, skill development and responsible for hiring and developing training plans.
• Ensure the delivery and performance of security operations, incident response and compliance reporting of healthcare requirements and expectations within project constraints.
• Evolve and mature the 24/7 service delivery capabilities including staffing, SLAs and service delivery management.
• Comply with the Springfield Clinic incident reporting policy and procedures.
• Adhere to all OSHA and Springfield Clinic training & accomplishments as required per policy.
• Provide excellent customer service and adhere to Springfield Clinic's Code of Conduct and Ethics Standards.
• Perform other job duties as assigned.

Education/Experience

• Bachelor's degree in cyber security, Information Technology, Business, or related field.
• 5+ years of technical security experience, with 3+ years of experience leading cloud security managed services and 1+ years of operating a cyber incident response or security operations team within a large enterprise organization.
• Demonstrated experience with security operations, incident response and compliance reporting for cloud-based systems in compliance with HIPAA, HITECH and PCI DSS requirements.
• Must have experience with industry leading security technologies Microsoft Azure, Tenable Nessus, AWS, Google, SIEM
• 24/7 Operations Experience is required.

Licenses/Certificates

• CISA, CompTIA Security + or similar security certifications required.

Knowledge, Skills and Abilities

• Ability to actively communicate, interact and solve critical users problems.
• Ability to think and act strategically and proactively.
• Ability to work independently with minimal direction or supervision.
• Familiarity with automated response and remediation technologies
• Strong leadership and interpersonal skills that includes excellent operational rigor with extensive real-world experience leading and responding to large scale, complex incidents.
• Solid grasp of common cyber frameworks and models such as the MITRE ATT&CK, Cyber Kill Chain, as well as best practices on forensics, ransomware playbooks and modern penetration testing techniques
• Ability to communicate complex and technical issues to diverse audiences, verbally and in writing, in an easily understood, authoritative, and actionable manner.

Working Environment

• This job operates in a professional office environment. Routinely uses standard office equipment such as computers, phones, photocopiers, filing cabinets and fax machines.

PHI/Privacy Level

HIPAA1