Assoc. Manager, IT Security

Responsibilities Design, develop, and maintain automated security workflows that ingest, enrich, deduplicate, prioritize, and respond to alerts generated by SIEM platforms and related detection technologies. Engineer automated triage and response logic that reduces manual analyst effort, improves alert quality, and accelerates incident response across Security Operations. Build integrations between security platforms and ticketing / case management systems to enable consistent case creation, enrichment, evidence capture, escalation, documentation, and stakeholder communication. Integrate threat intelligence, asset context, identity signals, vulnerability data, and other enrichment sources into automated detection and response pipelines to support risk-based decision-making. Lead automation for detection and rule lifecycle management, including tuning, validation, deployment, rollback planning, measurement, and continuous improvement of security use cases. Partner with Security Services subject matter experts to translate operational pain points, incident response requirements, and detection engineering needs into scalable automation. Develop and maintain reusable scripts, API integrations, workflow components, libraries, and runbook patterns that improve automation consistency and reduce duplicate engineering effort. Define and apply automation standards for code quality, peer review, version control, testing, documentation, change management, and operational supportability. Monitor production automation health, investigate failed or degraded workflows, and improve resiliency, observability, exception handling, and alerting for mission-critical automation services. Evaluate emerging cyber threats and operational trends, then implement or improve automated coverage through new detections, enrichments, response actions, or reporting capabilities. Lead smaller automation projects or defined phases of broader Security Operations initiatives, coordinating tasks, dependencies, testing, implementation, and handoff with cross-functional partners. Mentor junior engineers or analysts on automation patterns, troubleshooting, secure coding practices, workflow design, and platform best practices. Maintain accurate runbooks, workflow documentation, architecture notes, operational handoff materials, and evidence required for audits, change reviews, or leadership reporting. Participate in on-call or critical incident support for high-impact automation services as required by the Security Operations support model. Required Skills Strong programming and scripting capability in Python, PowerShell, JavaScript, or similar languages, with experience building reliable automation for security operations use cases. Hands-on experience with SIEM and SOAR platforms, detection logic, alert enrichment, automated playbooks, workflow orchestration, and downstream response integrations. Strong understanding of SOC operations, incident response workflows, detection engineering, security telemetry, alert lifecycle, triage patterns, and case handling processes. Experience designing and consuming REST APIs, webhooks, event-driven integrations, and data exchange patterns across security tools, cloud services, and internal platforms. Working knowledge of threat frameworks such as MITRE ATT&CK, Cyber Kill Chain, or similar models, with the ability to operationalize them through automation and detection use cases. Understanding of network protocols, endpoint telemetry, identity signals, cloud security controls, vulnerability data, and other security context used for enrichment and response. Familiarity with CI/CD pipelines, version control, code review, test automation, release documentation, and configuration management practices for production automation. Ability to independently analyze complex technical problems, evaluate trade-offs, and choose practical methods for reliable, supportable security automation. Strong written and verbal communication skills with the ability to explain technical automation design, operational impact, limitations, and risk-based recommendations to security and IT stakeholders. Qualifications 10–12 years of experience in cybersecurity, security operations, security engineering, detection engineering, incident response, or security automation roles. At least 10 years of experience operating within a SOC or enterprise security environment, with direct exposure to detection engineering, incident response workflows, and security tooling automation. Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field, or equivalent work experience. Demonstrated experience creating or significantly improving automation workflows, security integrations, rule lifecycle processes, response playbooks, or operational tools in a production environment. Demonstrated ability to work independently with minimal guidance on complex assignments and act as a technical resource for less experienced engineers or analysts. Experience collaborating across security, engineering, IT, cloud, platform, and vendor teams in a global or distributed enterprise environment. Proficient in written and spoken English. Preferred Qualifications Hands-on experience with SOAR platforms and workflow orchestration tools, including development of automated playbooks, integrations, enrichment workflows, and response actions. Experience automating security controls and response actions across AWS, Azure, GCP, or hybrid cloud environments. Exposure to infrastructure as code or configuration management tools such as Terraform, Ansible, or similar technologies for repeatable security automation. Knowledge of modern detection engineering practices, including use case development, false positive reduction, enrichment strategies, coverage mapping, and telemetry quality improvement. Experience with security automation reliability practices, including monitoring, retry logic, queue handling, error handling, performance tuning, and failure analysis. Advanced industry certifications such as CISSP, GIAC, cloud security certifications, or security automation-related credentials are a plus. Key Performance Indicators (KPIs) KPIs are intended to guide measurable performance expectations and may be refined based on platform ownership, automation maturity, Security Operations priorities, and business-critical use cases. Short-Term Outcomes (3–6 Months) Onboarding and environment fluency: Complete onboarding to Yum!’s Security Operations platforms, priority workflows, critical integrations, change processes, and stakeholder map within 90 days. Automation baseline: Establish or update an inventory of assigned automations, dependencies, owners, health status, runbooks, and known gaps within the first 90 days. Workflow delivery: Deliver at least 2–3 approved automation enhancements, playbooks, integrations, or workflow improvements in the first 3–6 months, with documented acceptance criteria and operational handoff. Change quality: Ensure at least 95% of assigned automation changes include version control, peer review, testing evidence, rollback guidance, and runbook updates. Operational responsiveness: Triage high-priority automation failures, degraded workflows, or production support requests within agreed SLAs and communicate impact, workaround, and remediation status clearly. Efficiency improvement: Reduce manual steps or average enrichment time by 10–15% for at least one prioritized alert, triage, or response workflow. Long-Term Outcomes (6–12+ Months) MTTA / MTTR improvement: Improve mean time to acknowledge, enrich, or respond for targeted security use cases by at least 20% through validated automation. Manual effort reduction: Reduce repeatable manual Security Operations effort by 25–30% across prioritized workflows through automation, enrichment, auto-ticketing, or response orchestration. Detection and response quality: Improve false positive handling, enrichment quality, or alert disposition accuracy by 15–20% for selected high-volume or high-risk use cases. Automation reliability: Maintain at least 99% availability or successful execution for business-critical automation workflows, excluding approved maintenance windows or dependent-platform outages. Lifecycle maturity: Implement or materially improve rule lifecycle, playbook lifecycle, code review, deployment, monitoring, and rollback practices for assigned automation services. Knowledge transfer: Mentor junior analysts or engineers through documented patterns, code reviews, troubleshooting sessions, and reusable automation templates. Functional KPI Categories Technical Delivery Number of production-ready playbooks, integrations, scripts, or reusable workflow components delivered against agreed backlog priorities. Percentage of delivered automations with documented acceptance criteria, test evidence, error handling, rollback instructions, and operational handoff. Adherence to coding, change management, peer review, version control, and documentation standards. Operational Efficiency Reduction in manual analyst steps, duplicate ticket handling, repetitive enrichment tasks, and avoidable escalations. Increase in percentage of alerts that are automatically enriched, routed, ticketed, suppressed, or escalated according to approved logic. Improvement in analyst feedback scores or stakeholder satisfaction for automated workflows and runbooks. Detection, Response & Risk Reduction Improvement in coverage for prioritized threat scenarios, MITRE ATT&CK techniques, or high-risk detection use cases through automation. Speed of deploying validated automation updates for urgent threats, new detections, or critical operational gaps. Measured improvement in quality of evidence, severity assignment, ownership, and remediation tracking for automation-generated tickets. Reliability, Governance & Leadership Production automation success rate, failure rate, recovery time, and repeat-incident trend for assigned workflows. Number and quality of code reviews, design reviews, runbook reviews, and knowledge-sharing sessions delivered for peers or junior team members. Timely reporting of automation outcomes, risks, technical debt, dependencies, and roadmap recommendations to Security Operations leadership. • Bachelor’s degree in computer science, Cybersecurity, Information Technology, or related field with 8-10 years of relevant experience