Foley is modernizing its technology infrastructure and expanding the use of AI across the business. We're looking for a hands-on Manager of IT Security to lead our security operations, strengthen our security posture, and proactively identify and address risks.
You'll manage one security engineer while remaining deeply involved in technical execution. This role requires someone who takes initiative, brings forward clear recommendations, and drives security improvements to completion. You'll partner closely with Infrastructure, Engineering, our AI team, and business stakeholders to protect Foley while enabling innovation.
WHAT YOU'LL DO
- Cloud & Identity Security: Lead security improvements across AWS, including IAM, multi-account governance, networking, and security monitoring. Manage identity and access controls through Microsoft Entra ID, Conditional Access, SSO/SCIM, and privileged access management.
- Endpoint & Security Operations: Maintain and strengthen endpoint security, patching, EDR coverage, and security monitoring across our managed fleet. Optimize existing security tools, including Rapid7, Intune, NinjaOne, and related platforms.
- Vulnerability Management & Incident Response: Own vulnerability management from detection and prioritization through remediation. Lead incident response, coordinate with our MDR provider, and drive corrective actions that reduce future risk.
- AI Security: Partner with our AI and Engineering teams to secure AI tools, agents, and integrations. Implement practical guardrails for data protection, access permissions, non-human identities, and responsible AI adoption.
- Security Compliance & Audits: Own Foley's SOC 2 Type II audit process end to end, including security controls, evidence collection, audit readiness, remediation, and direct coordination with external auditors. Maintain PCI DSS compliance requirements and support security policies and vendor risk assessments.
- Secure Engineering: Partner with Engineering to strengthen security across development environments, CI/CD pipelines, source control, and application integrations.
- Security Roadmap & Continuous Improvement: Proactively monitor emerging threats, evaluate security risks, and drive improvements. Develop and execute a prioritized security roadmap in partnership with the Director of Infrastructure.
- Team Leadership & Collaboration: Manage and develop a security engineer while partnering across Infrastructure, Engineering, Compliance, Legal, and business teams to strengthen security practices and support business priorities.
WHO YOU ARE
- 7+ years of information security experience, including experience leading security initiatives or programs and managing or formally leading security professionals.
- Strong hands-on AWS security experience, including IAM, multi-account governance, network security, and AWS-native security services such as GuardDuty, Security Hub, and CloudTrail.
- Deep experience with Microsoft Entra ID, Conditional Access, SSO/federation, privileged access, and identity lifecycle management.
- Demonstrated experience with endpoint security, vulnerability management, incident response, and MDR/SOC partnerships.
- Proven experience owning SOC 2 Type II audits end to end, including control implementation, evidence collection, audit coordination, and remediation.
- Working knowledge of AI security risks, including data leakage, over-privileged agents, non-human identities, and secure AI integrations.
- A proactive approach to identifying risks, recommending solutions, and driving improvements independently, with strong communication skills across technical and business audiences.
PREFERRED
- Experience with PCI DSS and security frameworks such as NIST CSF, ISO 27001, and CIS Controls.
- Relevant certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft SC-series.
- Scripting, automation, or infrastructure-as-code experience.
- Experience securing a distributed workforce in a lean…