IT Manager - Information Security

This position manages a team of AutoZoners in the development, implementation, and support of AutoZone’s existing and new software applications and hardware platforms that provide security controls. The IT Security Manager will be responsible for developing and implementing robust security measures, managing a team of security engineers, and ensuring the overall security of systems, networks, and data.

• Manage and lead a team of IT AutoZoners that includes assigning/monitoring work, providing feedback, coaching and development, counseling, and salary administration.
• Manages and tracks the progress of multiple projects. Performs project management and administration that includes work plans, resource planning and control, writing status reports, and preparing annual budgets.
• Communicates status of activities with teams, peers, management, and business partners

Builds relationship with key business partners to identify and resolve business issues
Selects, develops, and motivates assigned staff.

At least ten years security and / or cyber risk management experience in a large enterprise environment, including formal leadership responsibilities.

• People leadership/supervisory skills.
• Problem solving and analytical skills.
• Presentation, facilitation and writing skills.
• Project management – estimating, planning, controlling, and execution.

• Advanced knowledge of one or more of the following functional areas:

Infrastructure Security, e.g. Palo Alto NGFW (hardware, virtual, and cloud-native), Prisma Access, enterprise network segmentation, secure web gateways/proxies, Zero Trust / ZTNA, NAC / 802.1X, Cisco ISE, GCP network and infrastructure security, Cloud Armor, VPC Service Controls, cloud security posture management, enterprise PKI and certificate lifecycle management (Keyfactor), TLS and cryptographic standards, key management, post-quantum cryptography readiness, endpoint security, and security controls for AI-enabled endpoints.

• Application Security and Automation, e.g. application security program management, secure SDLC, enterprise CI/CD pipelines, SAST, SCA, DAST, SBOM, penetration testing, code reviews, API security, Akamai WAF/CDN, vulnerability management, software supply chain security, application secrets management (CyberArk Conjur, Google Secret Manager), Infrastructure as Code (Terraform), security automation and policy-as-code, cloud-native application security, GKE/container security, and AI/LLM application and agent security.

• Identity and Access Management, e.g. enterprise identity providers (Ping Identity / PingFederate / PingOne / Ping AIC), LDAP, SSO, SAML, OAuth 2.0, OpenID Connect, JWT, MFA, SCIM, identity lifecycle management, Privileged Access Management, GCP IAM, service accounts, Workload Identity Federation, workload/machine identity, and Identity-Aware Proxy (IAP).