Senior Manager, Corporate Security

General Description: 

The Senior Manager, Corporate Security leads the corporate security function and its day-to-day operations and owns the corporate security roadmap. This role is accountable for protecting the organization’s corporate infrastructure, including identity, endpoints, networks, collaboration and SaaS platforms, and cloud and on-prem environments, through disciplined operations, sound architecture, and risk-based decision-making. The Senior Manager leads and develops a team of security professionals, stays close to high-impact technical work, and partners closely with GRC, Product Security and Corporate Security teams to deliver a consistent, coordinated security program across the organization.

The Senior Manager influences corporate infrastructure standards and investment decisions across IT and engineering, translates security risk into clear business terms for senior leadership, and provides input into budgeting, vendor selection, and vendor performance. 

How you'll make an impact:  

Corporate Security Leadership & Operations 

• Lead, coach, and develop the corporate security team, including hiring, onboarding, performance management, and succession planning. 
• Own day-to-day corporate security operations, including vulnerability and patch management, endpoint and email security, SaaS and identity security, and security monitoring. 
• Set team priorities, capacity plans, and on-call coverage, and balance operational demands against roadmap delivery. 
• Define operating cadences, runbooks, service levels, and metrics so operations are repeatable, measurable, and continuously improving. 
• Serve as the escalation point for corporate security issues, and stay hands-on where deep technical judgment is required. 

Corporate Security Roadmap & Strategy 

• Build, maintain, and communicate the corporate security roadmap (12–36 month horizon), refreshed at least annually and as risk or business priorities change. 
• Align the roadmap to business strategy, risk posture, and regulatory requirements, and prioritize initiatives by risk reduction and business impact. 
• Translate the roadmap into funded, sequenced initiatives with clear owners, milestones, and success measures. 
• Track and report delivery progress, risks, and outcomes to security and IT leadership. 

Corporate Infrastructure Influence & Architecture 

• Influence corporate infrastructure strategy and design with IT, cloud, and engineering teams so security is built in from the start. 
• Define and maintain security standards, guardrails, and reference patterns for cloud and on-prem corporate infrastructure. 
• Lead threat modeling and security design reviews for material infrastructure changes, with documented, risk-based recommendations. 
• Drive adoption of least privilege, segmentation, hardening baselines, and blast radius reduction across corporate environments. 

Partnership with GRC and Product Security 

• Partner with GRC on the risk register, control design, evidence, and audit readiness (e.g., SOC 2, ISO 27001, GDPR), providing technical validation for corporate controls. 
• Partner with Product Security on shared standards, tooling, vulnerability management, and incident response so corporate and product environments are protected consistently. 
• Establish clear responsibilities, handoffs, and escalation paths between Corporate Security, GRC, and Product Security. 
• Align roadmaps and priorities across the three groups, and surface cross-cutting risks and dependencies early. 

Risk, Controls & Compliance 

• Identify, assess, and prioritize corporate information security risks, and provide risk-based input into formal risk acceptance decisions. 
• Operate and continuously improve corporate security controls so they are measurable, effective, and aligned with regulatory and internal requirements. 
• Regularly assess configuration, access controls, and security posture, and drive remediation to closure. 

Detection, Incident Response & Resilience 

• Own detection and response capabilities for corporate environments, including tooling, playbooks, and tuning. 
• Lead or support response to high-severity security incidents, and coordinate with IT, Legal, Product Security, and leadership as needed. 
• Lead post-incident reviews and drive long-term remediation and resilience improvements. 

Automation, Platforms & Secure Enablement 

• Define and deliver strategies to automate and standardize security controls across corporate platforms, services, and business processes. 
• Establish security enablement patterns that integrate with IT and operational workflows. 
• Evaluate security tools, platforms, and frameworks for technical fit, operational impact, and risk reduction. 

Project Engagement & Delivery 

• Provide security direction, requirements, and acceptance criteria for infrastructure and IT projects. 
• Review designs and implementations for alignment with security standards and architecture. 
• Identify and escalate security-related delivery risks. 

Budget & Vendor Management 

• Provide input into corporate security budgeting and investment planning, and ensure initiatives and operations stay within approved budget. 
• Technically evaluate vendors and tools for security capability, risk, and architectural fit. 
• Monitor vendor performance, participate in renewals, and recommend changes based on performance and risk. 

Influence, Communication & Enablement 

• Act as a trusted advisor to senior leadership on corporate security risks and tradeoffs. 
• Translate complex technical security issues into clear, business-focused insights. 
• Influence engineering and IT teams through standards, design reviews, and technical leadership. 

Success Measures:

• Measurable reduction in corporate infrastructure security risk 
• Operational performance of the corporate security function (response and remediation times, coverage, and service levels) 
• On-time delivery and business impact of the corporate security roadmap 
• Effectiveness and adoption of security standards, architecture, and controls 
• Audit outcomes and defensibility, supported by effective collaboration with GRC 
• Effective alignment with Product Security and GRC 
• Team engagement, development, and retention 
• Vendor performance and risk posture 

Continuous Improvement:

• Stay current with emerging threats, technologies, and best practices. 
• Evaluate and implement new security tools, practices, and frameworks to strengthen corporate security posture and team effectiveness. 

What you'll Bring to the Role:

Competencies: 

• People leadership: able to build, coach, and retain a high-performing security team. 
• Strategic and analytical thinking for risk assessment, prioritization, and roadmap planning. 
• Ability to lead technical initiatives and influence cross-functional teams without direct authority. 
• Collaboration and partnership across GRC, Product Security, IT, Legal, and engineering. 
• Strong communication skills for technical and non-technical audiences, including senior leadership. 
• Continuous learning mindset and adaptability to evolving security landscapes. 

Skills: 

• Cloud security expertise (AWS, Azure) and infrastructure hardening. 
• Strong knowledge of network security, firewalls, VPNs, and identity and access management. 
• Experience running security operations and managing vulnerability, endpoint, and SaaS security programs. 
• Experience with security tools (SIEM, vulnerability scanners, compliance platforms). 
• Proficiency in scripting and automation (PowerShell, Python, Bash); familiarity with Infrastructure-as-Code (Terraform, CloudFormation) and CI/CD security integration. 
• Understanding of encryption, key management, and secure data handling. 
• Ability to build and communicate security roadmaps, business cases, and risk-based recommendations. 

Suggested Experience

• Bachelor’s degree in a related field, or equivalent experience. 
• 8+ years of progressive information security experience, including 3+ years leading security teams or functions. 
• Demonstrated experience building and delivering a security roadmap and operating a corporate or enterprise security function. 
• Experience partnering with GRC, audit, and product or application security teams in a SOC 2, ISO 27001, or similar compliance environment. 
• Hands-on experience securing cloud (AWS, Azure) and on-prem corporate infrastructure. 
• Security certifications such as CISSP, CISM, or CCSP preferred.