Security Triage Manager

Job Requisition ID #

25WD88680

Position Overview

In the role of Triage Manager, you will be responsible for overseeing the full spectrum of security alert triage across Autodesk's global infrastructure. Your primary objective is to ensure that all Tier 1 alerts are promptly actioned and resolved while efficiently routing more complex issues to seasoned security analysts. You will manage a team that includes both internal staff and vendor personnel, and you'll work collaboratively with our Detections and Monitoring groups to fine-tune alert configurations and drive automation initiatives. Your expertise in managing alerts across on-premises systems and cloud platforms (Azure, AWS, and GCP) will be vital in maintaining a robust, responsive security posture.

• Alert Management & Triage: Oversee and streamline the alert triage process, ensuring all Tier 1 alerts are promptly acknowledged, investigated, and resolved. Ensure that higher complexity alerts are escalated to more seasoned analysts for in-depth investigation
• Team Coordination: Lead a mixed team of full-time employees and vendor staff, ensuring optimal coverage and efficient operations within the alert queues
• Provide mentorship, operational guidance, and continuous training to team members
• Process Optimization: Collaborate with Detections and Monitoring teams to tune alert thresholds, reduce false positives, and eliminate noise. Identify which alerts are suitable for automation and partner with engineering teams to develop and deploy automated solutions
• Multi-Cloud Alert Management: Manage and maintain situational awareness of alerts coming from diverse environments including on-premises, Azure, AWS, and GCP infrastructures. Ensure consistent triage standards are applied across all platforms
• Operational Reporting & Improvement: Develop and maintain metrics to evaluate alert handling performance. Produce regular status reports to drive continuous improvement in triage processes
• Collaboration & Communication: Serve as a critical communication bridge between frontline security operations and higher-level incident response teams. Ensure clear, timely, and accurate documentation and communication of triage activities and incident escalations

• Experience: Minimum of 5+ years in security operations or incident response, with at least 2 years in a supervisory or management role overseeing alert triage or a similar SOC function
• Technical Skills:
  
  
  • Strong command of SIEM platforms, especially Splunk, with proven experience in configuring and optimizing alerting mechanisms
  • Solid understanding of telemetry integration and alert correlation across varied data sources in both on-prem and cloud environments
• Operational Expertise:
  
  
  • Demonstrated experience managing high-volume security alert environments, with the ability to make swift, informed decisions under pressure
  • Expertise in developing and refining alert triage processes, reducing noise, and automating routine tasks
• Soft Skills:
  
  
  • Exceptional leadership and communication skills; capable of effectively managing a mixed team of internal and vendor staff
  • Strong analytical and problem-solving abilities to quickly assess and escalate security incidents
• Cloud Agnostic: Proven knowledge of and experience with managing security alerts across multiple cloud platforms, including Azure, AWS, and GCP