Manager, Business Security Enablement

Description

JOB DESCRIPTION

Manager, Business Security Enablement

Cybersecurity Technology and Operations

Reports To Director, Cybersecurity Technology and Operations

Team Leadership Five direct reports: Information Security Architect; Senior Security Controls Engineer; Junior Security Controls Engineer; AI Automation and Integration Engineer; SOC Engineer.

Role Profile Hands‑on people and technical delivery leader responsible for building security into business change.

Primary Outcome Execute and deliver the Business Security Enablement portfolio and Cybersecurity Technology Strategic Roadmap with measurable, sustainable operating results.

POSITION SUMMARY

The Manager, Business Security Enablement reports to the Director, Cybersecurity Technology and Operations and leads the team that translates cybersecurity strategy, architecture and risk priorities into scalable, measurable security capabilities embedded in business and technology change. The Manager is accountable for the execution and sustained operation of the Business Security Enablement portfolio: security architecture; cloud, application and DevSecOps security; security controls engineering and implementation; security consulting; data loss prevention; and data encryption and cryptographic lifecycle capabilities.

This role turns the Cybersecurity Technology Strategic Roadmap into an integrated, outcome‑based delivery plan. It leads a multidisciplinary team, partners across technology and business functions, and remains hands‑on in architecture, delivery decisions, problem solving and technical escalation. The Manager establishes clear ownership, disciplined execution and practical operating models that are measurable, supportable, resilient and aligned to enterprise risk priorities.

KEY RESPONSIBILITIES

Strategy, Roadmap and Portfolio Delivery

• Translate the Director-approved cybersecurity strategy and 2027–2028 technology roadmap into prioritized workstreams, quarterly delivery plans, milestones, technical dependencies, measures, risks and sustained operating ownership.
• Own execution and delivery of the Business Security Enablement roadmap, including control automation, detection and response enablement, risk‑based remediation, cryptographic resilience, secure AI automation and reusable integration capabilities.
• Establish a common delivery backlog, reusable integration patterns and transparent delivery cadence; standardize platforms and data flows before scaling automation.
• Run weekly delivery and operational reviews, monthly KPI/KRI, platform‑performance and risk reviews, and contribute to quarterly architecture, risk and investment‑priority reviews.
• Escalate material delivery blockers, architecture tradeoffs, control gaps, technical debt, resource constraints and residual risks to the Director with clear options and recommendations.

Business Security Enablement, Architecture and Engineering

• Lead day‑to‑day delivery of security patterns, technical standards, reference architectures, design reviews and security consulting that build security into business and technology change.
• Guide secure cloud, application, data and hybrid‑technology designs; ensure appropriate threat modeling, secure configuration, protection requirements, implementation guidance and documented design decisions or exceptions.
• Embed security into the software and service delivery lifecycle through DevSecOps practices, including secure coding guidance, SAST/DAST and dependency‑security integration, CI/CD protections, policy‑as‑code, release evidence and remediation pathways.
• Direct the engineering and implementation of resilient, measurable security controls, including configuration baselines, drift detection, control validation, compensating controls and auditable implementation evidence.

Automation, Integration, Control Assurance and Data Protection

• Drive automation of control mapping, evidence collection and validation, control testing, assessments, workflow orchestration, KPI reporting and risk‑informed remediation; support vendor and software assessments and policy/procedure lifecycle needs.
• Lead secure AI‑enabled workflows, services and integrations across security tools and technology platforms. Apply bounded autonomy, least privilege, approval gates, audit logging, testing and evaluation, monitoring, rollback/kill‑switch capabilities, and clear human‑accountability tiers.
• Ensure AI automation and integration capabilities follow a documented control lifecycle from intake and design through build/test, deployment, monitoring and incident‑learning evidence.
• Advance data loss prevention and data‑encryption controls, including technical delivery for automated key and certificate lifecycle capabilities, monitoring, exception handling, secure configurations and audit evidence.
• Prioritize vulnerability, exposure and non‑patch remediation using risk‑based methods and coordinate compensating controls, validation and closure evidence with accountable technology owners.

SOC Engineering and Detection Enablement

• Direct the SOC Engineer's delivery of telemetry and asset coverage, detection engineering, scanning/detection/reporting, investigation automation, IOC search, threat‑hunting support, incident timelines and post‑incident artifacts.
• Improve the quality, reliability and adoption of security monitoring, alerting, investigation and workflow capabilities; ensure runbooks, escalation paths, operational health measures and sustainable support ownership are defined.
• Coordinate security engineering enablement for GitHub monitoring and alerting, threat research, control‑validation testing and approved adversary‑testing activities in alignment with the broader security operating model.

People Leadership, Partnership and Assurance

• Lead, coach and develop the Information Security Architect, Senior and Junior Security Controls Engineers, AI Automation and Integration Engineer, and SOC Engineer; establish goals, quality expectations, work priorities, performance feedback and succession/skills‑development plans.
• Create a high‑accountability, collaborative culture that balances speed, security effectiveness, resilience, usability, cost and sustainable operations. Promote knowledge transfer, peer review, disciplined change management and continuous improvement.
• Partner with application development, cloud/platform engineering, infrastructure, DevOps, enterprise architecture, data, risk, compliance, privacy, legal, audit and business teams to align delivery with enterprise priorities and control obligations.
• Define and report outcome‑based KPIs/KRIs, including roadmap progress, control coverage/effectiveness, evidence quality and timeliness, remediation aging/exposure reduction, detection coverage, automation value, service reliability and secure‑delivery adoption.
• Provide concise, risk‑based updates and audit‑ready evidence for leadership, governance forums, audits and regulatory examinations; support remediation of identified findings and validate closure.

CORE TECHNOLOGY AND SECURITY DOMAINS

Business Security Enablement Domain Manager Accountability

• Security Architecture & Consulting Deliver security patterns, standards, reference architectures, design reviews and practical advisory support that embed security into business and technology change.
• Cloud, Application & DevSecOps Security Advance secure cloud and application design, threat modeling, secure SDLC practices, CI/CD security, configuration assurance, policy‑as‑code and remediation guidance.
• Security Controls Engineering & Implementation Engineer, deploy, validate and continuously improve security controls, configuration baselines, compensating controls and implementation evidence.
• Control Assurance & Risk‑Based Remediation Automate control mapping, evidence collection and validation, testing, workflow orchestration, vulnerability/exposure prioritization, non‑patch remediation and outcome reporting.
• SOC Engineering & Detection Enablement Direct telemetry and asset coverage, detection engineering, investigation and response automation, threat‑hunting support, operational artifacts and control‑validation activities.
• AI Automation & Integration Deliver secure, reusable APIs, workflows, integrations and AI‑enabled capabilities with bounded autonomy, approvals, auditability, monitoring and sustainable operational ownership.
• Data Protection & Cryptographic Resilience Advance data loss prevention, data‑encryption controls and technical delivery for automated key/certificate lifecycle capabilities, monitoring, exceptions and audit evidence.

REQUIRED QUALIFICATIONS

• Bachelor's degree in cybersecurity, information technology, computer science, engineering or a related field; equivalent relevant experience may be considered in accordance with organizational policy.
• Five or more years of progressive experience in information security, technology engineering, operations or related IT disciplines, with demonstrated delivery across multiple relevant technical domains.
• Two or more years of people management and/or technical team leadership, including hiring, coaching, performance management, work prioritization and delivery accountability.
• Hands‑on experience delivering security architecture, security engineering, cloud or application security, DevSecOps, control automation, security operations engineering or closely related capabilities in hybrid or cloud environments.
• Demonstrated ability to translate strategy into executable roadmaps, manage cross‑functional dependencies, make risk‑informed technical decisions and sustain capabilities after implementation.
• Working knowledge of security frameworks and control‑evidence practices, including NIST and/or ISO‑aligned approaches, audit support, risk treatment and regulatory/compliance expectations.
• Strong written, verbal and executive communication skills, with the ability to explain technical risk, delivery tradeoffs, metrics and recommendations to technical and business audiences.

PREFERRED EDUCATION AND CERTIFICATIONS

• Master's degree in cybersecurity, information technology, business, engineering or a related discipline.
• Relevant professional certifications such as CISSP, CISM, CCSP, CSSLP, cloud‑security, security‑architecture, DevSecOps, automation or AI‑security credentials.
• Experience with AWS and/or Azure; SIEM/SOAR/XDR, vulnerability or exposure management, DLP, encryption/key/certificate lifecycle capabilities, CI/CD and infrastructure‑as‑code, APIs, event‑driven integration or workflow orchestration.

LEADERSHIP AND WORKING STYLE

• Demonstrates personal accountability, sound judgment and integrity; follows through from concept to sustained operational adoption.
• Balances strategic leadership with practical technical depth, visible delivery ownership and thoughtful escalation.
• Uses risk‑based prioritization and transparent tradeoffs while maintaining disciplined security and control standards.
• Builds trusted partnerships across Information Security, IT and business teams without bypassing governance or control accountability.
• Promotes reusable, simplified and automated solutions that improve resilience, reduce friction and create durable operating value.
• Develops technical talent, manages performance fairly and creates an environment of learning, collaboration and continuous improvement.

Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.

EEO Statement

ACA provides equal employment opportunities (EEO) to all applicants for employment without regard to race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, marital status, amnesty, or status as a covered veteran in accordance with applicable federal, state and local laws. ACA complies with applicable state and local laws governing non‑discrimination in employment in every location in which the company has facilities.

California Privacy Notice

As an employer of California residents, we are dedicated to protecting your privacy rights. Any personal information you provide during the application process will be used solely for permitted internal purposes and will be handled in accordance with applicable privacy laws. By applying to this position, you consent to the collection, use, and disclosure of your personal information as described in our Employee Privacy Notice .