安全运营与基础设施经理
Manager of Security Operations and Infrastructure
Schellman 是一家排名前50的会计事务所，也是审计和合规服务领域的领先提供商。我们的专业服务专注于安全和隐私审计、评估和认证。Schellman 在不提供任何传统会计服务的情况下，已成为美国最大的网络安全评估公司之一。我们是安全、隐私、业务连续性和质量领域的经认证的多框架 ISO 认证机构；是全球授权的 PCI 合格安全评估师，也是为联邦国防部客户提供服务的顶级供应商，作为领先的 FedRAMP 3PAO 和首个获得 CMMC C3PAO 授权的评估公司。我们的专长和专业知识始终在于提供一流的网络安全和 IT 审计及鉴证服务。我们的文化、与客户的合作方式以及对价值观的承诺，使我们一直被评为 Great Places to Work 认证公司，并被 Accounting Today 评为最佳工作公司，被 Glassdoor 评为最佳工作场所。我们非常重视员工，这体现在我们的首要核心价值观——以人为本。这在我们的文化、福利以及我们处理业务的方式中都有体现。来看看什么让 Schellman 特别吧！
**职位简介**
**申请流程：**
**您必须完成此练习才能被考虑录用此职位。**
请发送您的简历以及对以下问题的回答，代替求职信。这是一个简短的练习，用于模拟您可能在此职位中被要求进行的聊天/邮件请求。它应该需要大约15分钟，且故意是开放式的，您可以根据自己的判断决定详细程度。用最适合您的方式（文字、图表等）来分享您的解决方案。
**请确保以以下格式标记文档：FirstName_LastName_SchellmanDevOpsExercise**
**评估问题 1：安全控制实施与运营影响**
您被指派在组织内实施 DLP（数据防泄漏）强制措施。这将需要安全团队与业务部门之间进行大量协调，影响用户的工作流程，并影响多个系统。请描述您的方法：（1）在部署前评估运营和业务影响，（2）在管理层中建立共识和认可，（3）规划和分阶段实施以最小化干扰，（4）在不损害关键业务操作的前提下衡量成功。
**评估问题 2：团队能力发展**
您的安全和基础设施团队目前的能力如何？您会如何制定计划来提升他们的技能和效率？
查看英文原文
Schellman is a Top 50 CPA firm and a leading provider of attestation and compliance services. Our professional services focus on security and privacy audits, assessments, and certifications. Schellman has become one of the largest cybersecurity assessment firms in the United States without providing any traditional accounting services. We are an accredited multi-framework ISO Certification Body for security, privacy, business continuity, and quality; a globally licensed PCI Qualified Security Assessor and a top provider to clients serving the federal DoD space as a leading FedRAMP 3PAO and the first assessment firm authorized as a CMMC C3PAO. Our specialty and expertise remain in providing best in class Cybersecurity and IT Audits and Attestations. Our culture, approach with clients, and dedication to our values has led us to consistently be a Great Places to Work certified company and rated as a Best Firms to Work For by Accounting Today and a Glassdoor Best Places to Work. We deeply appreciate our employees, as shown by our first core value – People Come First. This is demonstrated in our culture, benefits, and how we handle business. Come see what makes Schellman special!
**JOB SUMMARY**
**Application Process:**
**You must complete this exercise to be considered for this role.**
Please send your resume as well as an answer to the question below in lieu of a cover letter. This is a short exercise to simulate a chat/email request you might be asked in this role. It should take about 15 minutes and is intentionally open-ended, you can go into as much or little detail as you feel is necessary. Communicate in whatever ways work best for you (words, diagrams, etc.) to share your solution.
**Be sure to label the document in this format: FirstName_LastName_SchellmanDevOpsExercise**
**ASSESSMENT QUESTION 1: Security Control Implementation & Operational Impact**
_You're tasked with implementing DLP (Data Loss Prevention) enforcement across the organization. This will require significant coordination between security and the business, impact user workflows, and affect multiple systems. Describe your approach to: (1) Assessing operational and business impact before rollout, (2) Building alignment and buy-in across Leadership, (3) Planning and phasing the implementation to minimize disruption, and (4) Measuring success without compromising critical business operations._
**ASSESSMENT QUESTION 2: Team Capability Development**
_Your security and infrastructure team is growing. Describe how you would: (1) Identify skill gaps and capability needs across the team, (2) Decide between hiring specialists versus developing existing team members' capabilities, and (3) Create a mentorship or learning plan to build expertise_
**ASSESSMENT QUESTION 3: Cloud Infrastructure Scaling for Growth**
_As the organization grows, your cloud infrastructure must scale reliably and cost-effectively. Describe your approach to: (1) Assessing current infrastructure capacity and identifying gaps for future growth, (2) Planning a scaling strategy that balances performance, cost, and operational complexity, and (3) Explain your framework for deciding which processes, tasks, or functions deserve automation investment and why, given limited resources and time._
The Manager of Security Operations & Infrastructure is a hands-on player-coach leadership role responsible for the security and operational integrity of Schellman's technology infrastructure. This role oversees the Security Operations (SecOps) and DevOps functions, with a primary emphasis on building and maturing the SecOps program. This role reports to the Director of IT and is a key member of the CTO organization, contributing to IT strategy, security governance, and cross-functional initiatives across a ~500-person professional services firm.
Essential Functions:
- Lead and mature Schellman's SecOps program, including threat detection, incident response, vulnerability management, and security monitoring
- Own the day-to-day operations of security tooling across the environment, including EDR, SIEM, and related platforms
- Drive security incident response processes, including escalation procedures, post-incident reviews, and continuous improvement
- Partner with Compliance and Risk teams to support internal security controls and other frameworks relevant to Schellman's operations
- Manage and develop SecOps Engineers, providing mentorship, prioritization support, and career growth opportunities
- Lead vulnerability management efforts including prioritization, remediation tracking, and executive reporting
- Provide management oversight for the DevOps team
- Partner with the Senior DevOps Engineer on technical direction, infrastructure decisions, and delivery execution — leveraging their expertise while providing organizational leadership and prioritization support
- Champion security integration across the DevOps lifecycle, including CI/CD pipeline security, IaC security standards, and cloud security posture management
- Support cloud security operations across AWS and Microsoft Azure environments
- Serve as a key stakeholder in Schellman's IT governance and AI governance programs
- Collaborate with the Director of IT and CTO on security strategy, roadmap planning, and budget inputs
- Represent the SecOps and DevOps functions in cross-departmental initiatives
- Communicate security posture, risks, and program updates clearly to IT leadership and non-technical stakeholder
**Knowledge, Skills, and Abilities:**
- 5+ years of experience in security operations, cybersecurity engineering, or a related discipline
- 1–3 years of people management or formal team lead experience
- Strong working knowledge of SecOps domains: SIEM, EDR, incident response, threat intelligence, and vulnerability management
- Familiarity with DevOps concepts and cloud infrastructure — enough to lead DevOps engineers effectively and speak credibly to technical decisions
- Hands-on experience with Microsoft and Okta security and identity platforms preferred
- Excellent communication skills with the ability to translate technical risk into business context
- Collaborative, low-ego leadership style — comfortable empowering technical leads and building consensus across functions
- **Our ideal candidate is located in the Eastern time zone**
**Education, Work Experience and Certifications** **:**
- Security certifications such as CISSP, CISM, Security+, or equivalent
- Experience at a professional services, audit, or compliance firm
- Exposure to SOC 2, FedRAMP, CMMC, or ISO 27001 is a strong plus
Schellman is an equal opportunity employer (EOE) and strongly supports diversity in the workplace; therefore, providing equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law. Schellman uses E-Verify in our hiring process.
At Schellman, we strive to provide a flexible and balanced environment and therefore offer the opportunity to work remotely, unless otherwise stated in the job requirements. Connecting, collaborating and continuous education are also highly valued and therefore we require some travel annually for our Internal Service Delivery roles, which can include in-person training, team meet-ups, and strategy meetings. Service Delivery team members will also be required to travel based on business and client needs.