SUMMARY/JOB PURPOSE:

The Associate Director, Product Management - Cybersecurity Operations & Engineering designs, implements, manages, and improves secure technology solutions for the organization's information systems. The position is responsible for analyzing the organization's current cybersecurity infrastructure and identifying any weaknesses or vulnerabilities that must be addressed. This position works with other teams and business groups to develop and implement security solutions that align with the organization's security policies and objectives. The Associate Director, Product Management - Cybersecurity Operations & Engineering is also responsible for creating and maintaining the organization's cybersecurity architecture, including the design of security controls, policies, and procedures. The position will also lead and coordinate incident response efforts, collaborating with cross-functional teams; analyze security incidents, assess their impact, and drive resolution; enhance existing incident response methods, tools, and processes; collect, assess, and catalogue threat indicators; communicate incident response actions to both technical and non-technical management.

In addition, the role will also provide guidance and direction to other IT professionals regarding security best practices and ensure that all security measures comply with industry standards and regulations.

ESSENTIAL DUTIES AND RESPONSIBILITIES:

• Work closely with other stakeholders, such as business leaders and technology managers, to ensure that security measures are aligned with business objectives and provide adequate protection against threats.
• Responsible for identifying and assessing the organization's potential attack surface, which includes all the external and internal systems, assets, and processes that cyber attackers could target, and working with several teams to prioritize and remediate any identified vulnerabilities or weaknesses in the organization's infrastructure.
• Work with other security team members to develop and implement security policies, procedures, and controls to ensure the confidentiality, integrity, and availability of an organization's information assets.
• Implement and manage a program to detect and analyze anomalous behavior and indicators of compromise that may indicate a security breach.
• Work closely with other security team members, such as security analysts and incident responders, to investigate and analyze security incidents, including but not limited to malware infections, unauthorized access attempts, and other security breaches, and determining the scope and impact of the incident and developing remediation measures to prevent future incidents.
• Provide detailed incident reports, communicate with stakeholders, and recommend remediation measures to prevent future incidents.
• Improve the organization's security posture by identifying weaknesses and vulnerabilities in its security infrastructure and recommending solutions to address them.
• Collaborate with third-party vendors and partners to ensure security measures are in place for shared systems and data.
• Responsible for vendor management, including product and vendor evaluation, contract negotiation, supplier relationship management, and consulting management.
• Stay current with the latest threat landscape and emerging trends in cybersecurity to proactively identify and mitigate potential security risks.
• Contribute to the overall information security strategy.
• Recruit, motivate, mentor, and lead talent to be their best.

SUPERVISORY RESPONSIBILITIES:

• Provide direction to other individuals.
• Manage third-party service providers and consultants.
• Supervises staff, including hiring, scheduling and assigning work, reviewing performance, and recommends salary increases, promotions, transfers, demotions, or terminations.

EDUCATION/EXPERIENCE/KNOWLEDGE & SKILLS:

• Bachelor's degree in related discipline and eleven years of related experience; or
• Master's degree in related discipline and nine years of related experience; or
• PhD degree in related discipline and five years of related experience; or
• Equivalent combination of education and experience
• CSSP, CCSP, CISSP, CISM or similar certification required

Experience:

• Demonstrated experience and success in designing and implementing a comprehensive security architecture that protects an organization's information assets and enables it to achieve its business objectives
• Demonstrated experience and success in leadership roles in information technology and security operations
• Experience successfully executing programs that meet the objectives of excellence in a dynamic business environment
• Experience or working knowledge of cloud, network, and application security
• Experience with risk management methodologies
• Experience in Biotech/Pharma is a plus

Knowledge/Skills/Abilities:

• Proven experience in cybersecurity operations, incident response, and threat management.
• In-depth knowledge of security tools and techniques, including but not limited to SIEM (Security Information and Event Management), threat intelligence, incident response, vulnerability scanners, network mapping tools, threat intelligence platforms, threat hunting, threat detection, threat prevention, cybersecurity technologies, threat landscape, and emerging trends to identify and assess the organization's attack surface
• Deep understanding of various security technologies and tools, including firewalls, intrusion detection and prevention systems, identity and access management, encryption, and vulnerability management
• Deep understanding of security frameworks and standards such as, but not limited to, NIST, ISO 27001, and PCI-DSS. Ability to interpret these standards and apply them to an organization's specific security needs
• Knowledge of common information security and data management frameworks
• Up-to-date knowledge of methodologies and trends in both business and IT
• Comprehensive knowledge of DNS, network protocols, firewalls, VPNs, web application firewalls, email security, IPS/IDS, SIEM, DLP, cryptography, application whitelisting, and endpoint protection
• Ability to assess and prioritize security risks based on the potential impact on the organization
• Ability to communicate complex security concepts and technical information to various stakeholders, including executives, IT teams, and business leaders. They should also be able to collaborate effectively with other security team members and other Exelixis groups
• Strong leadership skills and be able to manage and mentor other security team members
• Excellent analytical and problem-solving skills, be able to work independently and as part of a team and have strong communication skills
• Excellent leadership and communication skills, be able to work well under pressure and possess strong analytical and problem-solving abilities
• Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies
• Ability to foster collaborative working relationships with technology groups and other stakeholders, including vendor relationships
• Ability to lead others irrespective of reporting structure
• Thorough planning and tracking skills, well-organized, focused on results, capable of managing multiple projects, excellent time management with respect to priorities and self-management
• Excellent judgment and problem-solving skills, including negotiation and conflict resolution
• Ability to leverage both internal and external resources to expedite and deliver projects
• Ability to work in a team environment, create timelines, and continually make necessary adjustments
• Excellent writing, presentation, and oral communication skills

WORKING CONDITIONS:

• Environment: primarily working indoors in an office environment

#LI-EZ1