Sr. Manager of Security Operations, Incident Response

Advance-Auto-Parts; Raleigh (NC); Hybrid; USD 180,000 - 230,000; Full time

Job summary

Advance Auto Parts in Raleigh, NC seeks a Sr. Manager of Security Operations to lead the SOC, incident response, and threat hunting, ensuring rapid detection, containment, and remediation across the enterprise.

This senior leader will drive the security program roadmap, establish dashboards and KPIs, and coordinate with Legal, Privacy, and business leadership to strengthen resilience against ransomware, cloud threats, and insider risks.

Qualifications

• 10+ years of cybersecurity, incident response, and threat intelligence with a focus on operational excellence.
• Proven leadership in security architectures, security tools and controls, cloud, governance, or risk management.
• Experience with cybersecurity frameworks (NIST, ISO 27001, MITRE ATT&CK).

Responsibilities

• Lead and mature Advance Auto Parts' Security Operations Center (SOC) capabilities including 24x7 monitoring, triage, escalation, analysis, and response.
• Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity.
• Establish and track service-level objectives, KPIs, and operational metrics.
• Drive continuous improvement of security operations processes, procedures, workflows, and automation.
• Own the enterprise Cybersecurity Incident Response Program and serve as Incident Commander during high-severity events.

Skills

Leadership

Security Operations

Incident Response

Threat Intelligence

MITRE ATT&CK

SIEM

SOAR

EDR

Cloud Security

Risk Management

Tools

SIEM

SOAR

EDR

Vulnerability Management

Cloud Security Tools

Job description

Job DescriptionThe Sr. Manager, Security Operations is a senior cybersecurity leadership role responsible for leading Advance Auto Parts' enterprise security monitoring, detection, incident response, cyber crisis management, threat hunting, and operational resilience capabilities.This leader is accountable for the strategic direction, operational effectiveness, and continuous improvement of the Security Operations Center (SOC) and Incident Response (IR) program. The role is responsible for ensuring threats are rapidly detected, investigated, contained, eradicated, and remediated while minimizing risk to business operations, customers, team members, and company reputation.The Sr. Manager will partner across Cybersecurity, Technology, Legal, Privacy, Corporate Communications, Risk Management, Store Operations, Supply Chain Operations, and Business Leadership to advance the company's cyber defense capabilities and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.This role is based out of our corporate headquarters in Raleigh, NC. This is a hybrid work model (4 days in office, 1 day work from home)Security Operations LeadershipLead and mature Advance Auto Parts' Security Operations Center (SOC) capabilities.Oversee 24x7 security monitoring, triage, escalation, analysis, and response activities.Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity.Establish and track service-level objectives, KPIs, and operational metrics.Drive continuous improvement of security operations processes, procedures, workflows, and automation.Incident Response & Cyber Crisis ManagementOwn and manage the enterprise Cybersecurity Incident Response Program.Serve as Incident Commander during high-severity cybersecurity events.Lead response activities for ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and major security incidents.Coordinate containment, eradication, recovery, and business restoration efforts.Lead executive communications during significant cyber events.Ensure alignment with legal, regulatory, compliance, privacy, and cyber insurance requirements.Threat IntelligenceDrive improvements in enterprise detection capabilities across cloud, endpoint, network, identity, applications, and third-party environments.Partner with Engineering and Architecture teams to improve detection coverage and response automation.Lead use case development aligned to MITRE ATT&CK and emerging threat intelligence.Establish detection effectiveness metrics and continuously improve signal-to-noise ratios.Oversee tuning and optimization of monitoring technologies.Lead proactive threat hunting operations to identify advanced attacker activity.Leverage threat intelligence to improve security monitoring, investigations, and response readiness.Maintain visibility into threat actor activity, TTPs, emerging campaigns, and vulnerabilities impacting the retail industry.Collaborate with external intelligence providers, ISACs, law enforcement, and industry partners.Cyber Preparedness & ResilienceLead tabletop exercises and cyber crisis simulations.Conduct ransomware preparedness exercises and executive-level response testing.Ensure incident response playbooks remain current and actionable.Perform post-incident reviews and drive corrective actions.Maintain enterprise readiness for significant cyber events.Metrics, Reporting & GovernanceDevelop operational dashboards and executive reporting.Present security operations metrics, incident trends, threat intelligence insights, and program maturity updates to executive leadership.Report on:Mean Time to Detect (MTTD)Mean Time to Respond (MTTR)Incident Severity TrendsDetection EffectivenessThreat Hunting OutcomesSOC Performance MetricsAutomation EffectivenessSupport Board, Audit Committee, and executive cybersecurity reporting.Leadership & Talent DevelopmentLead, mentor, and develop security analysts, incident responders, threat hunters, and detection engineers.Build a high-performing cybersecurity operations culture focused on accountability, resilience, and continuous improvement.Establish workforce development plans and professional growth opportunities.Support recruiting and retention of cybersecurity talent.Qualifications:10+ years of experience in cybersecurity, incident response and threat intelligence with a strong focus on operational excellence.Proven leadership experience in security architectures, security tools and controls, cloud, operations, governance, or risk management.Strong background in process improvement methodologies (Lean, Six Sigma, ITIL, Agile).Experience with cybersecurity frameworks (NIST, ISO 27001, MITRE ATT&CK).Familiarity with security technologies (SIEM, SOAR, EDR, cloud security tools, vulnerability management).Excellent communication and leadership skills to drive alignment across security, IT, and business teams.Preferred Qualifications:Certifications: CISSP, CISM, CISA, ITIL,Experience in large-scale, complex organizations or highly regulated industries.Expertise in cybersecurity automation and analytics.We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state or local protected class. We comply with all applicable federal, state, and local laws.California Residents click below for Privacy Notice:https://jobs.advanceautoparts.com/us/en/disclosures