Global Senior Manager, Cybersecurity

Position Purpose

Core Cybersecurity

• Security Operations: in collaboration with the Amsted SOC, owns BAC's security monitoring, detection, and response across the enterprise and the tools that support it (SIEM, EDR, XDR).
• Incident Response: owns creation and execution of the incident response program (plans, playbooks, tabletop exercises, and live response); leads incident response readiness, investigations, crisis coordination, and executive communications.
• Vulnerability & Threat Management: in collaboration with the Amsted SOC, runs the enterprise vulnerability management program, including scanning, patch prioritization, penetration testing, and red/purple team exercises, with clear metrics on time-to-remediate.
• Identity & Access Security: in collaboration with the Amsted SOC and Amsted security council, design and implement a comprehensive security program spanning IAM, endpoint protection, DLP, and threat intelligence.
• Security Architecture: partner with Enterprise Architecture and Infrastructure to embed security requirements into network, cloud, and application architecture decisions.
• Governance, Risk, and Compliance: owns the security policy framework and leads the enterprise through relevant audits and certifications (e.g., SOC 2, ISO 27001, NIST CSF) and supports customer and regulatory security questionnaires.
• Security Awareness: runs the company's security awareness and phishing simulation program, including establishment and publishing of metrics.
• Third-Party & Vendor Risk: in collaboration with the Amsted SOC, owns the vendor security risk assessment process for new and existing suppliers, systems integrators, and SaaS platforms.

Product Security

• Secure Development Lifecycle: build and run a secure SDLC program for internally developed applications and configuration/product engineering tools, including threat modeling, secure code review, and security testing gated into the release process.
• Product & Connected Systems Security: own the security requirements for the company's engineered products and any connected/embedded components, including coordination with engineering on secure-by-design practices.
• Application Security Testing: run static and dynamic application security testing (SAST/DAST) and manage remediation of findings across custom-developed applications and the broader integration landscape.

AI Security

• AI Security Risk: in collaboration with the Amsted SOC, own the security review process for AI tools and use cases, including Microsoft 365 Copilot and any custom or third-party AI/LLM deployments, covering risks such as data leakage, prompt injection, model access controls, and unsafe output.
• AI Governance Partnership: partner directly with the Director, AI, Data, and Emerging Tech Advancement to ensure AI governance policy is followed and enabled by security controls.
• Emerging Risk Monitoring: track the evolving AI threat landscape (adversarial AI, model theft, data poisoning) and translate it into practical controls embedded into the organizational way of working.

Global Considerations

• Global Security Strategy: design and execute cybersecurity strategy across the company's global footprint, adapting controls and program design to local regulatory requirements.
• Global Region Regulations Experience: ensure cybersecurity strategy incorporates operation in highly regulated regions such as China, including practical handling of data localization, cross-border transfer restrictions, and state-level regulatory frameworks (e.g., China's Cybersecurity Law, PIPL, a
• Global Complexity and Risk Awareness: advise IT and business leadership on the security and data risk implications of operating in, or expanding into, higher-risk regions.

Nature and Scope

Knowledge & Skills

• Experience: 8+ years in cybersecurity, with 3+ years in a leadership or senior management role owning a security program end to end.
• CISSP certification required; additional certifications such as CISM, OSCP, GIAC (GCIH/GPEN/GWAPT), or CCSP are a strong plus.
• Direct experience running core security operations, including SOC oversight, incident response, vulnerability management, in a corporate IT environment of comparable scale.
• Hands-on secure SDLC / application security experience: demonstrated experience embedding security into software development and deployment.
• Working knowledge of AI security risk (LLM/AI-specific threats) and application of proportionate controls to a self-service AI program that is still maturing.
• Direct, hands-on experience building or executing a cybersecurity program in a complex multinational environment, China specifically preferred, including familiarity with local regulatory frameworks and cross-border data requirements.
• Manufacturing, industrial, or engineer-to-order environment experience, including OT/connected product security exposure, is a strong plus.
• Experience operating within an SAP or major ERP landscape is a plus, given the tight coupling between security and the company's core systems.
• A direct, clear communication style, ability to objectively explain cyber risk and trade-offs to executives, leading with facts and presenting recommendations with clear outcomes and risks.

Working Conditions

• This position may require travel both domestically and internationally for up to 30% of the time.

Compensation & Benefits

• BAC Hiring Compensation Range $133,300-$228,600.
• BAC offers a comprehensive benefits package to include medical, dental, vision, paid time off, 401k, employee stock ownership plan, and more.
• BAC Employees are eligible to participate in an annual bonus incentive program.