Cybersecurity Manager

Simmons Bank; Dallas (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

Simmons Bank is hiring a Cybersecurity Manager to lead the SOC and drive incident response, vulnerability management, and threat intelligence programs. The role oversees staffing, training, and performance while building scalable security operations across the bank.

You will implement and test incident response playbooks, coordinate with IT and business units, and ensure audits and regulatory requests are met with strong reporting and risk governance.

Qualifications

• Five (5) years of information security or cybersecurity experience.
• Three (3) years of experience supervising and leading security operations personnel.
• Banking or financial services experience preferred.
• Experience with SIEM and log aggregation technologies; writing queries for investigations and threat hunts.
• Experience leading incident response at an appropriate level in prior roles.
• Experience with vulnerability management processes, scanning tools, risk analyses and metrics reporting.

Responsibilities

• Develop and maintain the Security Operations Center (SOC) program.
• Direct a team of SOC analysts, delegating tasks to support daily security detection and response.
• Develop use-cases and content for security monitoring and automated workflows.
• Coordinate with internal teams and external providers for security assessments.
• Develop and test incident response plans and playbooks as Incident Commander for incidents.

Skills

Security Operations

Incident Response

Vulnerability Management

Threat Hunting

Threat Intelligence

SIEM

DLP

Automation/SOAR

Cloud Security

Education

CISSP/CISM/GCIH/GSOC or equivalent certifications

Bachelor's or Master's degree in a related field

Tools

APIs integration

Scripting

Vulnerability scanners

Job description

It's fun to work in a company where people truly BELIEVE in what they're doing!We're committed to bringing passion and customer focus to the business.SummaryAt Simmons Bank, the Cybersecurity Manager is an essential leader within the Information Security team. The SOC provides continuous security monitoring and incident response; conducts security awareness and training; and manages security threats and vulnerabilities.The Cybersecurity Manager oversees the activity of the SOC team, including hiring, training, and performance management. The Cybersecurity Manager also maintains strong operational programs; assesses escalated security events and threats; and develops, implements and tests incident response plans and playbooks.Additional responsibilities include supporting the Bank’s audits and examinations; supporting risk assessments related to the SOC; reporting the SOC’s operational metrics, and reporting on SOC activities to IT and business leaders.Essential Duties and ResponsibilitiesSecurity OperationsDevelop and maintain the Security Operations Center (SOC) ProgramDirect a team of SOC analysts, delegating tasks as required to support daily cyber security detection and response activitiesDevelop and maintain processes to enhance detection and response capabilitiesDevelop use-cases and content for security event monitoring and automated workflowsMonitor SOC analyst performance against defined SLAs and metricsCoordinate with Red Team and external service providers to scope and execute security assessmentsIncident ResponseDevelop, implement, and test incident response plans with SOC, IT and business unitsOversee the development of written SOC response playbooksManage the incident response process serving as Incident Commander for declared cybersecurity incidentsManage an insider threat program, including data loss preventionOversee SOC analysts’ response to DLP alerts and escalationsServe as security liaison for Fraud and Compliance investigationsServe as quality control and security liaison for legal collectionsSecurity EducationOversee security awareness and training program, including content selection and developmentOversee security awareness phishing simulations and tabletop exercisesProvide guidance, education, and content to other departments and business units on cyber related matters as well as communicating capabilities of the SOC teamThreat and Vulnerability ManagementLead and manage the vulnerability management processSupport application security scanning and vulnerability risk analysisManage threat hunting and threat intelligence programsManage program to protect digital assets from abuse and takedown processOversee the analysis of vendor vulnerability releases (e.g. Patch Tuesday)Research new trends and advances in cybersecurity to stay updated on potential threats and best practicesAdvise business and technology leadership for potential changes in security postureRecommend and direct changes in automated tools supporting the monitoring and threat landscapeAdministrativeDevelop written standards for respective areas and contributes to the overall Information Security Policy and ProgramResponds to audit, compliance, and regulatory requests, as needed (e.g. SOX audit)Participate in periodic business reviews with vendors and internal customersManage staffing, including supervision, scheduling, development, evaluation, and disciplinary actionsDevelop and maintain an environment of growth where knowledge and performance are consistently advancingDevelop and mentor staff through open communication and training opportunities; build and maintain employee morale and motivationQualificationsWork ExperienceFive (5) years of experience in information security or cybersecurityThree (3) years of experience supervising and leading security operations personnelBanking or Financial Services experienced (preferred)Experience within Security Operations Center, Fusion Center, or MSP/MSSP (preferred)Experience with vulnerability management process, scanning tools, risk analysis and metrics reportingExperience investigating intrusions in a cloud/hybrid environmentExperience with SIEM and/or log aggregation technologies, writing queries to support investigations and threat huntsExperience with security tool integrations (APIs) and automating processes with scripting and SOAR (preferred)Experience leading incident response activities at an appropriate level in prior rolesEducation and CertificationsCISSP, CISM, GCIH, GSOC or other security related certifications (required)Multiple certifications across security disciplines (preferred)Bachelor’s or Master’s degree in a related field (preferred)Other Qualifications (including physical requirements)Ability to balance multiple responsibilities and prioritize effectivelyStrong sense of urgency and focus on timely execution of deliverablesStrong operational mindset and high degree of accountabilityStrong situational awareness and proactive, concise communicatorProficient with the MITRE attack framework and common threat vectorsProficient with security of Windows operating systemsStrong oral and written communication skillsStrong organizational, problem solving, and planning skillsMust possess excellent telephone and customer service skillsMust be willing to periodically work non-standard hours and be on callPlease note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Activities, duties and responsibilities may change at any time with or without notice.Equal Employment Opportunity Information: Simmons First National Corporation and its subsidiaries are committed to a policy of equal employment with respect to a person's race, color, religion, sex, ancestry, sexual orientation, gender identity, national origin, covered veterans, military status, physical or mental disability or any other legally protected classifications.