Security Operations Leader - Incident Response & IAM

Weber Blackstone; Providence (UT); On-site; USD 140,000 - 157,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Life and disability insurance

Employee Assistance Program (EAP)

401(k) with company match

Paid time off (vacation, sick, holiday

Job summary

Weber Blackstone is seeking an experienced Security Operations Lead to run detection, response, and vulnerability management across our hybrid environments. You will triage alerts from EDR/SIEM and drive incident response, coordinating with MDR/MSSP partners and internal teams.

The role requires hands-on investigation, playbook maintenance, and quarterly accessReviews across IT and OT assets. You will administer SSO/MFA and privileged access, align with PCI DSS/audits, and lead a small security

Qualifications

• 6+ years in IT security or security-focused infrastructure roles, including 3+ years leading people
• Bachelor's degree in computer science, information systems or a related field, or equivalent experience
• Hands-on experience with EDR, SIEM and email security tools, and with investigating and containing real incidents
• Working knowledge of identity and access management: SSO, MFA, Active Directory or Entra ID, and privileged access
• Experience running a vulnerability management program with scanning tools and patch tracking
• Familiarity with security frameworks such as NIST CSF or CIS Controls, and with supporting PCI DSS or IT audits
• Experience working with managed security providers and holding them to service levels
• Clear writer and communicator who can explain risk to non-technical colleagues

Responsibilities

• Manage daily detection and response, working with our managed security partner (MDR/MSSP) and escalating as needed
• Triage and investigate alerts from EDR, SIEM, email security and cloud tools; tune rules to cut noise
• Lead incident response for most incidents, and support the Sr. Director on major ones; keep playbooks current
• Run tabletop exercises and post-incident reviews, and track follow-up actions to closure
• Run vulnerability scanning and patch tracking across servers, endpoints, network and cloud, with clear remediation SLAs
• Coordinate penetration tests and verify fixes
• Maintain secure configuration baselines for endpoints, servers, firewalls and cloud accounts
• Partner with Operations on basic protections for plant and warehouse systems (OT)
• Administer SSO, MFA and privileged access controls, and help unify identity across the Weber and Blackstone environments
• Run quarterly access reviews and improve joiner-mover-leaver processes with HR and IT
• Gather evidence and remediate findings for PCI DSS, IT general controls and other audits
• Complete security reviews of new vendors and SaaS tools against our third-party risk standard
• Keep security policies and procedures up to date, and propose changes to the Sr. Director
• Produce monthly security metrics: open vulnerabilities, incidents, patch compliance and phishing results
• Lead, coach and schedule a team of 2-3 security engineers and analysts, including on-call coverage
• Run security awareness training and phishing simulations for offices, plants and distribution centers
• Be the go-to security contact for IT, Engineering and business teams on day-to-day questions

Skills

Team leadership

Incident response

Security leadership

EDR

SIEM

Identity and access management

Cloud security

Communication

PCI/DSS audits

Education

Bachelor's degree in CS/IS or related field

Tools

CrowdStrike Falcon

Microsoft Defender

Splunk

Microsoft 365 security

Google Workspace security

Active Directory

Entra ID

Job description

Weber Blackstone is seeking an experienced Security Operations Lead to run detection, response, and vulnerability management across our hybrid environments. You will triage alerts from EDR/SIEM and drive incident response, coordinating with MDR/MSSP partners and internal teams.

The role requires hands-on investigation, playbook maintenance, and quarterly accessReviews across IT and OT assets. You will administer SSO/MFA and privileged access, align with PCI DSS/audits, and lead a small security