Sr. Manager of Security Operations, Incident Response

Advance Auto Business Support (300); Raleigh (NC); Hybrid; USD 170,000 - 250,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Advance Auto Parts is seeking a Sr. Manager, Security Operations to lead the enterprise SOC, IR program, and threat intelligence efforts from our Raleigh headquarters.

The senior leader will drive detection, containment, and remediation, ensuring rapid response to ransomware, cloud compromises, insider threats, and third-party breaches. The role collaborates across Cybersecurity, Legal, Privacy, Compliance, and Business leadership to strengthen enterprise resilience and cyber defense

Qualifications

• 10+ years of experience in cybersecurity, incident response and threat intelligence.
• Strong leadership experience in security architectures, tools and controls.

Responsibilities

• Lead and mature Security Operations Center (SOC) capabilities.
• Oversee 24x7 security monitoring, triage, escalation, analysis, and response activities.
• Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity.
• Establish and track service-level objectives, KPIs, and operational metrics.
• Drive continuous improvement of security operations processes, procedures, workflows, and automation.
• Own and manage enterprise Cybersecurity Incident Response Program; serve as Incident Commander during high-severity events.

Skills

Leadership

Incident response

Threat intelligence

Security operations

Process improvement

Tools

SIEM

SOAR

EDR

Job description

Job Description The Sr. Manager, Security Operations is a senior cybersecurity leadership role responsible for leading Advance Auto Parts' enterprise security monitoring, detection, incident response, cyber crisis management, threat hunting, and operational resilience capabilities. This leader is accountable for the strategic direction, operational effectiveness, and continuous improvement of the Security Operations Center (SOC) and Incident Response (IR) program. The role is responsible for ensuring threats are rapidly detected, investigated, contained, eradicated, and remediated while minimizing risk to business operations, customers, team members, and company reputation.

The Sr. Manager will partner across Cybersecurity, Technology, Legal, Privacy, Corporate Communications, Risk Management, Store Operations, Supply Chain Operations, and Business Leadership to advance the company's cyber defense capabilities and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.

This role is based out of our corporate headquarters in Raleigh, NC. This is a hybrid work model (4 days in office, 1 day work from home).

Security Operations Leadership

Lead and mature Advance Auto Parts' Security Operations Center (SOC) capabilities.

Oversee 24x7 security monitoring, triage, escalation, analysis, and response activities.

Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity.

Establish and track service-level objectives, KPIs, and operational metrics.

Drive continuous improvement of security operations processes, procedures, workflows, and automation.

Incident Response & Cyber Crisis Management

Own and manage the enterprise Cybersecurity Incident Response Program. Serve as Incident Commander during high-severity cybersecurity events.

Lead response activities for ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and major security incidents.

Coordinate containment, eradication, recovery, and business restoration efforts.

Lead executive communications during significant cyber events.

Ensure alignment with legal, regulatory, compliance, privacy, and cyber insurance requirements.

Threat Intelligence

Drive improvements in enterprise detection capabilities across cloud, endpoint, network, identity, applications, and third-party environments.

Partner with Engineering and Architecture teams to improve detection coverage and response automation.

Lead use case development aligned to MITRE ATT&CK and emerging threat intelligence.

Establish detection effectiveness metrics and continuously improve signal-to-noise ratios.

Oversee tuning and optimization of monitoring technologies.

Lead proactive threat-hunting operations to identify advanced attacker activity.

Leverage threat intelligence to improve security monitoring, investigations, and response readiness.

Maintain visibility into threat actor activity, TTPs, emerging campaigns, and vulnerabilities impacting the retail industry.

Collaborate with external intelligence providers, ISACs, law enforcement, and industry partners.

Cyber Preparedness & Resilience

Lead tabletop exercises and cyber crisis simulations.

Conduct ransomware preparedness exercises and executive-level response testing.

Ensure incident response playbooks remain current and actionable.

Perform post-incident reviews and drive corrective actions.

Maintain enterprise readiness for significant cyber events.

Metrics, Reporting & Governance

Develop operational dashboards and executive reporting.

Present security operations metrics, incident trends, threat intelligence insights, and program maturity updates to executive leadership.

Report on: Mean Time to Detect (MTTD) Mean Time to Respond (MTTR) Incident Severity Trends Detection Effectiveness Threat Hunting Outcomes SOC Performance Metrics Automation Effectiveness.

Support Board, Audit Committee, and executive cybersecurity reporting.

Leadership & Talent Development

Lead, mentor, and develop security analysts, incident responders, threat hunters, and detection engineers.

Build a high-performing cybersecurity operations culture focused on accountability, resilience, and continuous improvement.

Establish workforce development plans and professional growth opportunities.

Support recruiting and retention of cybersecurity talent.

Qualifications

10+ years of experience in cybersecurity, incident response and threat intelligence with a strong focus on operational excellence.

Proven leadership experience in security architectures, security tools and controls, cloud, operations, governance, or risk management.

Strong background in process improvement methodologies (Lean, Six Sigma, ITIL, Agile).

Experience with cybersecurity frameworks (NIST, ISO 27001, MITRE ATT&CK).

Familiarity with security technologies (SIEM, SOAR, EDR, cloud security tools, vulnerability management).

Excellent communication and leadership skills to drive alignment across security, IT, and business teams.

Preferred Qualifications

Certifications: CISSP, CISM, CISA, ITIL.

Experience in large-scale, complex organizations or highly regulated industries.

Expertise in cybersecurity automation and analytics.

Equal Opportunity Employer

We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state or local protected class. We comply with all applicable federal, state, and local laws.

Advance Auto Parts, Inc. is a leading automotive aftermarket parts provider that serves both professional installers and do-it-yourself customers. As of October 5, 2024, Advance operated 4,781 stores primarily within the United States, with additional locations in Canada, Puerto Rico and the U.S. Virgin Islands. The company also served 1,125 independently owned Carquest branded stores across these locations in addition to Mexico and various Caribbean islands. Additional information about Advance, including employment opportunities, customer services and online shopping for parts, accessories and other offerings can be found at www.AdvanceAutoParts.com.