Security Operations Manager

Position Description Position: Security Operations Manager (IT Professional A) in Seattle Information Technology’s Security and Infrastructure Division. Department Overview The City of Seattle is a leading local government in environmental stewardship and social justice. Seattle Information Technology (Seattle IT) delivers secure, reliable, and responsible technology solutions that help the City provide equitable and effective services to our communities. Our team of more than 600 IT professionals supports a full spectrum of modern enterprise services and offers dynamic career paths. Responsibilities The Security Operations Manager leads a team of skilled cybersecurity professionals, driving excellence in detection, assessment, response, and resolution of cybersecurity incidents. The role reports to the Chief Information Security Officer and Assistant Chief Technology Officer for Security & Infrastructure and partners closely with the cybersecurity risk team, peer cybersecurity teams across City Departments, and Seattle IT leaders. Technical Leadership Manage and lead ongoing improvements in Seattle IT’s citywide incident detection and response program, including development and enhancement of plans, processes, and tools. Coordinate detection engineering, SIEM/SOAR operations, telemetry, forensic investigations, threat intelligence sharing, enterprise event log collection, and threat hunting activities. Validate the effectiveness of cybersecurity defenses and incident response readiness through measurable metrics, tabletop exercises, and role‑playing teams. Lead Security Operations’ contribution to the City’s vulnerability management program, providing operational metrics and supporting a risk‑based approach to remediation. Adapt Security Operations cyber defense capabilities in anticipation of City projects, strategic direction, and industry shifts. Maintain strong operational relationships and processes between Security Operations and security partners across the City’s public safety, utility, transportation, and operational technology environments. Assume incident command or other designated roles in cybersecurity incidents as defined by the relevant incident response plan. Review response plans to ensure compliance, federal, and state reporting requirements are documented and current. Negotiate vendor contracts to strengthen security posture while maintaining cost effectiveness. Strategic Leadership Develop cybersecurity strategic roadmaps aligned with Seattle IT and City goals, advising senior leadership on issues, challenges, trends, and opportunities. Provide overall management and coaching of the security operations staff, including training, performance assessment, and KPI attainment. Establish strategic partnerships with city peers in cybersecurity risk, privacy, infrastructure, endpoint, identity, and related domains. Evaluate vendor and managed service relationships for value, performance, and alignment with strategic roadmaps. Maintain awareness of industry trends and adjust approaches and roadmaps as needed. Communicate effectively with all levels of the organization. Lead executive briefings and incident command communications during events, exercises, and readiness reviews. Support sister agencies in cybersecurity practices, protocols, and incident response. Incorporate the City’s Race and Social Justice Initiative values into daily work. Engage in strategic leadership and partnership with S&I divisional leadership and Seattle IT-wide management bodies. Manage the Security Operations team’s annual budget, forecasting, tracking, and cost savings. Be available to work outside business hours when responding to incident scenarios. Qualifications NOTE: Equivalent combinations of education and experience will be considered. Education Bachelor’s degree or equivalent experience in a technology‑related field. Experience Seven years’ combined experience in information technology, with a significant portion in cybersecurity roles. Five years of managerial experience leading, mentoring, and developing a technical team, including cybersecurity. General Knowledge, Skills and Experience Advanced knowledge of attack tactics, techniques, and practices used by threat actors, and networking technologies, protocols, and common security tools. Demonstrated ability to develop, improve, and exercise incident response plans and procedures. Significant experience with cyber incident response. Additional Requirements Ability to pass Criminal Justice Information Services (CJIS) background check within six months of hire. Desired Qualifications Knowledge of a breadth of technical domains, including one or more of servers, identity, cloud, database, and applications. Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) certification. Experience with red/purple/blue teaming, penetration testing, tabletop exercises, and other assurance activities. Understanding of federal, state, and regulatory compliance drivers relevant to municipal governments and utility organizations. Experience leading union‑represented staff. Experience successfully handling vendor relationships. Additional Information Salary range: $62.59 – $93.90 per hour. Targeted salary up to $92.50 per hour based on experience and skills. Benefits The City of Seattle offers a comprehensive benefits package including vacation, holiday, sick leave, medical, dental, vision, life, and long‑term disability insurance for employees and dependents. Equal Opportunity This role is open to all candidates that meet the minimum qualifications. The City encourages people of all backgrounds to apply, including people of color, immigrants, refugees, women, LGBTQ+, people with disabilities, veterans, and those with diverse life experiences. Background Check This position requires a Criminal Justice Information Services (CJIS) background investigation as a condition of employment, and incumbents must maintain that authorization in accordance with applicable FBI CJIS Security Policy personnel security requirements. #J-18808-Ljbffr