Role Overview The Security Team Leader leads day-to-day cybersecurity operations and ensures that security risks, incidents, vulnerabilities, and control deficiencies are identified, prioritized, communicated, and addressed effectively.

This role provides operational and people leadership to the cybersecurity team, establishes risk-based priorities, coordinates work across internal teams and external service providers, and serves as the primary operational escalation point for significant security issues.

The position owns cybersecurity operational reporting and prepares security posture, risk, performance, and remediation updates for senior leadership. The Team Leader translates technical findings into clear business risks, recommended actions, and measurable outcomes.

The role requires sufficient technical depth across endpoint, identity, email, vulnerability, governance, automation, and operational technology security to guide investigations, challenge recommendations, assess control effectiveness, and support risk-based decisions.

Key Responsibilities:

- Lead day-to-day cybersecurity activities, including work prioritization, assignment, escalation, and follow-through.
- Establish operational priorities based on business risk, threat intelligence, active incidents, vulnerabilities, audit findings, and organizational objectives.
- Serve as the primary operational escalation point for cybersecurity incidents and significant control failures.
- Coordinate investigation, containment, remediation, recovery, and post-incident review activities.
- Ensure security incidents, service requests, exceptions, and remediation activities are documented, tracked, and closed.
- Maintain and improve incident response procedures, operational runbooks, escalation paths, and team readiness.
- Lead or participate in the cybersecurity on-call and incident escalation rotation as required.

People and Team Leadership

- Provide direction, coaching, mentoring, and technical guidance to cybersecurity team members.
- Establish clear performance expectations, individual responsibilities, and development objectives.
- Allocate work based on business priorities, operational risk, team capacity, and individual capabilities.
- Identify skill gaps and develop training, cross-training, and succession plans.
- Promote consistent documentation, knowledge sharing, accountability, and collaboration.
- Support performance management using objective job expectations and documented outcomes.

Security Technology and Control Oversight

- Provide technical oversight across endpoint detection and response, security monitoring, endpoint management, email security, identity protection, security awareness, automation, password management, and GRC capabilities.
- Review significant security configurations, policy changes, exceptions, and control recommendations.
- Ensure security platforms are appropriately monitored, maintained, and aligned with defined security requirements.
- Evaluate security alerts and investigation findings to confirm appropriate risk classification and response.
- Identify control gaps and coordinate corrective actions with infrastructure, network, application, cloud, operational technology, and business teams.
- Promote automation and process improvement through approved technologies.
- Ensure technology decisions and exceptions are supported by documented risk assessments.

Vulnerability and Exposure Management

- Oversee the identification, prioritization, assignment, and remediation of vulnerabilities and security exposures across endpoints, servers, cloud services, network devices, operational technology, and third-party applications.




- Establish risk-based remediation priorities using severity, exploitability, asset criticality, exposure, threat intelligence, and business impact.
- Track overdue remediation activities and escalate unresolved risks through the appropriate governance process.
- Coordinate with infrastructure, application, network, cloud, and operational technology teams to validate remediation and compensating controls.
- Report vulnerability trends, remediation performance, recurring root causes, exceptions, and accepted risks to leadership.

Identity and Access Security

- Provide oversight for identity security controls across CrowdStrike, Microsoft Entra ID and Active Directory.
- Support the review and improvement of authentication, privileged access, administrative roles, service accounts, access governance, and password management.
- Coordinate investigation and remediation of suspected account compromise, credential theft, unauthorized access, and privilege misuse.
- Ensure identity-related risks and control exceptions are documented and escalated appropriately.

Email Security and Security Awareness

- Oversee email threat detection, phishing investigations, user-reported messages, and business email compromise response.
- Monitor trends in phishing, impersonation, credential theft, and social engineering.
- Guide security awareness and phishing simulation activities based on observed organizational risk.
- Use measurable results to improve awareness content, technical controls, and targeted training.

Governance, Risk, Compliance, and Third-Party Risk

- Support maintenance of cybersecurity risk registers, control assessments, policies, standards, and exception processes.
- Coordinate cybersecurity responses for internal audits, external audits, customer assessments, and compliance reviews.
- Own or coordinate remediation plans for cybersecurity findings and ensure progress is documented.
- Align cybersecurity activities with recognized frameworks such as the NIST Cybersecurity Framework, and CIS Controls.
- Ensure material security risks are communicated to appropriate business and technology stakeholders.
- Oversee or support third-party cybersecurity risk assessments, vendor remediation activities, supply chain risk reviews, and the supporting vendor management platform.

Vendor and Managed Security Service Oversight

- Define service expectations, review performance, coordinate escalations, and track provider commitments and corrective actions.
- Validate that outsourced security services align with internal priorities, control requirements, incident response processes, and reporting standards.
- Coordinate onboarding, access, knowledge transfer, and operational integration for external service providers.

Reporting and Executive Communication

- Define and maintain cybersecurity key performance indicators, key risk indicators, service measures, and operational metrics.
- Produce clear reporting on incidents, vulnerabilities, control effectiveness, audit remediation, provider performance, and security improvement initiatives.
- Prepare and present quarterly cybersecurity posture and performance results to senior leadership.
- Translate technical issues into business impact, risk exposure, recommended decisions, and remediation priorities.




- Provide timely leadership communication during significant incidents or material changes in organizational risk.
- Ensure metrics are accurate, actionable, consistently defined, and connected to business outcomes.

Security Strategy and Continuous Improvement

- Support development of the cybersecurity strategy and drive execution of approved roadmap initiatives.
- Identify recurring operational issues and lead improvements through standardization, automation, documentation, and control enhancement.
- Monitor changes in the threat landscape, business environment, and security technology to recommend appropriate improvements.

Required Skills and Experience

- Cybersecurity experience, including at least 2-3 years leading, supervising, or directing the work of a security team.
- Demonstrated experience leading cybersecurity operations, incident response, vulnerability management, identity security, security engineering, or a combination of these functions.
- Experience supervising, mentoring, and providing work direction to cybersecurity professionals.
- Strong knowledge of endpoint detection and response, security monitoring, identity and access management, email security, vulnerability management, and security operations.
- Working experience with the listed technology stack or comparable enterprise security platforms.
- Experience leading enterprise vulnerability management and risk-based remediation efforts across diverse technology environments.
- Knowledge of cybersecurity governance, risk registers, policy exceptions, audit support, control assessment, and remediation tracking.
- Experience defining and reporting meaningful security KPIs, KRIs, service measures, and operational metrics.
- Ability to translate technical findings into business risk, operational impact, recommended actions, and executive-level decisions.
- Demonstrated ability to lead effectively during high-priority incidents and communicate clearly under pressure.
- Experience coordinating work across internal technology teams, external vendors, and managed security service providers.
- Strong organizational skills with the ability to manage competing priorities, escalations, and dependencies.
- Professional working proficiency in English and Spanish, with strong written and presentation skills in English.

Preferred Qualifications

- Experience leading security operations for a manufacturing or food production organization, including operational technology and industrial control system security considerations.
- Familiarity with recognized cybersecurity frameworks such as NIST CSF, and CIS Controls.
- Experience owning or supporting third-party risk management programs, supply chain risk reviews, customer security assessments, audits, and remediation activities.
- Experience managing a security function delivered through a managed service, outsourced delivery, or hybrid operating model.
- Experience leading significant security incidents and providing executive communication throughout investigation, containment, recovery, and post-incident review.
- Experience developing operational runbooks, security standards, incident response procedures, and security governance processes.
- Experience improving security operations through scripting, orchestration, workflow automation, or process standardization.

Education and Certifications

- Bachelor's degree in Computer Science, Information Security, Information Technology, or a related discipline, or equivalent practical experience.
- CISSP, CISM, or an equivalent security leadership certification is strongly desirable.
- CrowdStrike, Microsoft, or other relevant security certifications are desirable.

📌 Cyber Security Supervisor (México)
🏢 Genpact
📍 México