Senior Manager, Information Security

Role Overview

What You'll Do

• Lead and coach a multidisciplinary security team, including team development, hiring, and operating cadence.
• Own critical security KPIs and drive continuous improvement in the security posture.
• Drive the information security roadmap and manage vendors in alignment with CISO strategy.
• Oversee security operations and incident response as senior escalation lead during major events.
• Hold external security partners accountable for coverage, triage quality, and rapid response.
• Establish AI security standards for LLM integrations, RAG pipelines, and agentic workflows.
• Operationalize AI for security triage, threat detection, investigation, and reporting.
• Embed security into the SDLC through CI/CD automation, security tooling, secure API patterns, and threat modeling.
• Maintain the security risk register and vulnerability management lifecycle.
• Direct corporate security hygiene, phishing simulations, awareness training, and responsible disclosure.
• Partner with DevOps and GRC on infrastructure-as-code security, audits, and posture metrics.

What You'll Bring

• 10+ years of progressive information security experience, including 5+ years leading teams.
• Experience managing managers and individual contributors and developing both groups.
• Breadth across security operations, product and application security, and cloud security.
• Hands-on security operations experience on AWS and other cloud providers.
• Hands-on major incident response experience, including incident command and cross-functional coordination.
• Practical understanding of AI and LLM security risks, prompt injection, and agentic systems.
• Working knowledge of SAST, SCA, DAST, API and microservices security, and threat modeling.
• Deep understanding of cloud security, threat detection, and attacker tactics in containerized, API-driven environments.
• Hands-on WAF experience is required.
• Experience owning budgets, vendor selection, and managed-service relationships.
• Experience building or scaling security awareness and developer security champions programs.
• Bachelor's degree in Computer Science, Information Security, or equivalent practical experience.

Nice To Have

• Relevant certifications such as CISSP, CISM, or GCIH are desirable.
• IC-level credentials such as OSCP, CSSLP, or GWAPT are desirable.
• Experience in a SaaS product company with a multi-tenant architecture is desirable.
• Experience in a regulated or high-trust environment is desirable.

Where We Work

• Benevity uses a flexible hybrid approach with no set in-office requirement for people located near an office.
• Employees are trusted to choose in-person work when it supports onboarding, project work, collaboration, or team connection.

About Benevity