Sr. Manager of Security Operations, Incident Response

The Sr. Manager, Security Operations is a senior cybersecurity leadership role responsible for leading Advance Auto Parts' enterprise security monitoring, detection, incident response, cyber crisis management, threat hunting, and operational resilience capabilities. This leader is accountable for the strategic direction, operational effectiveness, and continuous improvement of the Security Operations Center (SOC) and Incident Response (IR) program. The role is responsible for ensuring threats are rapidly detected, investigated, contained, eradicated, and remediated while minimizing risk to business operations, customers, team members, and company reputation. The Sr. Manager will partner across Cybersecurity, Technology, Legal, Privacy, Corporate Communications, Risk Management, Store Operations, Supply Chain Operations, and Business Leadership to advance the company's cyber defense capabilities and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches. This role is based out of our corporate headquarters in Raleigh, NC. This is a hybrid work model (4 days in office, 1 day work from home) Security Operations Leadership Lead and mature Advance Auto Parts' Security Operations Center (SOC) capabilities. Oversee 24x7 security monitoring, triage, escalation, analysis, and response activities. Develop and execute the roadmap for security operations, detection engineering, threat hunting, and operational maturity. Establish and track service-level objectives, KPIs, and operational metrics. Drive continuous improvement of security operations processes, procedures, workflows, and automation. Incident Response & Cyber Crisis Management Own and manage the enterprise Cybersecurity Incident Response Program. Serve as Incident Commander during high-severity cybersecurity events. Lead response activities for ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and major security incidents. Coordinate containment, eradication, recovery, and business restoration efforts. Lead executive communications during significant cyber events. Ensure alignment with legal, regulatory, compliance, privacy, and cyber insurance requirements. Threat Intelligence Drive improvements in enterprise detection capabilities across cloud, endpoint, network, identity, applications, and third-party environments. Partner with Engineering and Architecture teams to improve detection coverage and response automation. Lead use case development aligned to MITRE ATT&CK and emerging threat intelligence. Establish detection effectiveness metrics and continuously improve signal-to-noise ratios. Oversee tuning and optimization of monitoring technologies. Lead proactive threat hunting operations to identify advanced attacker activity. Leverage threat intelligence to improve security monitoring, investigations, and response readiness. Maintain visibility into threat actor activity, TTPs, emerging campaigns, and vulnerabilities impacting the retail industry. Collaborate with external intelligence providers, ISACs, law enforcement, and industry partners. Cyber Preparedness & Resilience Lead tabletop exercises and cyber crisis simulations. Conduct ransomware preparedness exercises and executive-level response testing. Ensure incident response playbooks remain current and actionable. Perform post-incident reviews and drive corrective actions. Maintain enterprise readiness for significant cyber events. Metrics, Reporting & Governance Develop operational dashboards and executive reporting. Present security operations metrics, incident trends, threat intelligence insights, and program maturity updates to executive leadership. Report on: Mean Time to Detect (MTTD) Mean Time to Respond (MTTR) Incident Severity Trends Detection Effectiveness Threat Hunting Outcomes SOC Performance Metrics Automation