Cybersecurity Incident Commander Jobs in Raleigh, NC

Job Description
The Sr. Manager, Security Operations is a senior cybersecurity leadership role responsible for leading Advance Auto Parts' enterprise security monitoring, detection, incident response, cyber crisis management, threat hunting, and operational resilience capabilities.
This leader is accountable for the strategic direction, operational effectiveness, and continuous improvement of the Security Operations Center (SOC) and Incident Response (IR) program. The role is responsible for ensuring threats are rapidly detected, investigated, contained, eradicated, and remediated while minimizing risk to business operations, customers, team members, and company reputation.
The Sr. Manager will partner across Cybersecurity, Technology, Legal, Privacy, Corporate Communications, Risk Management, Store Operations, Supply Chain Operations, and Business Leadership to advance the company's cyber defense capabilities and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.
This role is based out of our corporate headquarters in Raleigh, NC. This is a hybrid work model (4 days in office, 1 day work from home)
Security Operations Leadership

• Lead and mature Advance Auto Parts' Security Operations Center (SOC) capabilities.
• Oversee 24x7 security monitoring, triage, escalation, analysis, and response activities.
• Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity.
• Establish and track service-level objectives, KPIs, and operational metrics.
• Drive continuous improvement of security operations processes, procedures, workflows, and automation.

Incident Response & Cyber Crisis Management

• Own and manage the enterprise Cybersecurity Incident Response Program.
• Serve as Incident Commander during high-severity cybersecurity events.
• Lead response activities for ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and major security incidents.
• Coordinate containment, eradication, recovery, and business restoration efforts.
• Lead executive communications during significant cyber events.
• Ensure alignment with legal, regulatory, compliance, privacy, and cyber insurance requirements.

Threat Intelligence

• Drive improvements in enterprise detection capabilities across cloud, endpoint, network, identity, applications, and third-party environments.
• Partner with Engineering and Architecture teams to improve detection coverage and response automation.
• Lead use case development aligned to MITRE ATT&CK and emerging threat intelligence.
• Establish detection effectiveness metrics and continuously improve signal-to-noise ratios.
• Oversee tuning and optimization of monitoring technologies.

• Lead proactive threat hunting operations to identify advanced attacker activity.
• Leverage threat intelligence to improve security monitoring, investigations, and response readiness.
• Maintain visibility into threat actor activity, TTPs, emerging campaigns, and vulnerabilities impacting the retail industry.
• Collaborate with external intelligence providers, ISACs, law enforcement, and industry partners.

Cyber Preparedness & Resilience

• Lead tabletop exercises and cyber crisis simulations.
• Conduct ransomware preparedness exercises and executive-level response testing.
• Ensure incident response playbooks remain current and actionable.
• Perform post-incident reviews and drive corrective actions.
• Maintain enterprise readiness for significant cyber events.

Metrics, Reporting & Governance

• Develop operational dashboards and executive reporting.
• Present security operations metrics, incident trends, threat intelligence insights, and program maturity updates to executive leadership.
• Report on:
  • Mean Time to Detect (MTTD)
  • Mean Time to Respond (MTTR)
  • Incident Severity Trends
  • Detection Effectiveness
  • Threat Hunting Outcomes
  • SOC Performance Metrics
  • Automation Effectiveness
• Support Board, Audit Committee, and executive cybersecurity reporting.

Leadership & Talent Development

• Lead, mentor, and develop security analysts, incident responders, threat hunters, and detection engineers.
• Build a high-performing cybersecurity operations culture focused on accountability, resilience, and continuous improvement.
• Establish workforce development plans and professional growth opportunities.
• Support recruiting and retention of cybersecurity talent.

Qualifications:

• 10+ years of experience in cybersecurity, incident response and threat intelligence with a strong focus on operational excellence.
• Proven leadership experience in security architectures, security tools and controls, cloud, operations, governance, or risk management.
• Strong background in process improvement methodologies (Lean, Six Sigma, ITIL, Agile).
• Experience with cybersecurity frameworks (NIST, ISO 27001, MITRE ATT&CK).
• Familiarity with security technologies (SIEM, SOAR, EDR, cloud security tools, vulnerability management).
• Excellent communication and leadership skills to drive alignment across security, IT, and business teams.

Preferred Qualifications:

• Certifications: CISSP, CISM, CISA, ITIL,
• Experience in large-scale, complex organizations or highly regulated industries.
• Expertise in cybersecurity automation and analytics.

We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state or local protected class. We comply with all applicable federal, state, and local laws.
California Residents click below for Privacy Notice:
https://jobs.advanceautoparts.com/us/en/disclosures