As a Cybersecurity Manager specializing in Offensive Security at M&T Bank, your primary responsibilities include leading the Offensive Security Operations team, developing and executing offensive security strategies in alignment with risk management objectives, overseeing red team operations, and coordinating with cross-functional teams to remediate security gaps. You will also present findings to senior leadership and manage team performance and development.

To qualify for the Cybersecurity Manager - Offensive Security position at M&T Bank, candidates should have a Bachelor's degree and at least 7 years of relevant work experience, including a minimum of 6 years in a cybersecurity function and at least 2 years in a managerial role. A strong understanding of cybersecurity principles is essential, alongside excellent communication and leadership skills.

The Cybersecurity Manager - Offensive Security role supports M&T Bank's cybersecurity objectives by leading the Offensive Security Operations team to proactively identify and address vulnerabilities. By collaborating with other departments, managing testing campaigns, and mentoring team members, you'll enhance the organization's overall security posture and ensure compliance with regulatory standards.

The work environment for the Cybersecurity Manager - Offensive Security at M&T Bank is hybrid, allowing you to work remotely two days a week while also providing opportunities for in-person collaboration at our Buffalo Tech Hub. This setup promotes flexibility and teamwork, enabling you to effectively lead your team while fulfilling responsibilities.

Success as a Cybersecurity Manager - Offensive Security at M&T Bank requires a combination of technical and soft skills. It’s crucial to have an expert knowledge of cybersecurity principles, strong communication skills to articulate technical information, and the ability to lead and mentor a team. Being able to manage competing priorities while influencing stakeholders across the organization is also vital.

When developing an offensive security strategy, I assess the current threat landscape and align the strategy with the organization's risk management objectives. It involves collaborating with various teams to understand vulnerabilities and planning red team operations that simulate real-world attacks.

In my previous role, I managed a team of cybersecurity professionals where I focused on fostering a collaborative environment. I implemented regular training and mentoring programs to ensure each team member could grow their skills and contribute to our strategic goals.

I led a penetration testing campaign that newly targeted critical infrastructure. We effectively identified numerous vulnerabilities, developed a comprehensive report outlining our findings, and worked closely with the engineering team to remediate them promptly, significantly enhancing the organization's security.

I actively monitor regulatory changes and partner with legal and compliance teams to ensure our cybersecurity policies and strategies align with any new requirements. Regular audits and compliance checks also help us stay ahead of potential discrepancies.

I frequently utilize frameworks such as MITRE ATT&CK and NIST to design offensive security simulations. These frameworks provide structured methodologies that help mimic real-world attack scenarios and assess the effectiveness of security controls.

I prioritize tasks based on their impact on the organization's security posture and compliance needs. Effective communication with stakeholders and team members is essential so that everyone understands the critical points and timelines.

Fostering collaboration begins with creating an open environment where team members feel valued. I encourage regular knowledge-sharing sessions where individuals can present on topics they are passionate about, enabling us to learn from one another and build stronger teamwork.

I believe in a transformational leadership style that focuses on inspiring and motivating team members. This approach not only fosters innovation and creativity but also empowers individuals to take ownership of their work.

Identifying security gaps involves systematic testing and analysis. During red team operations, I gather data through various methods, analyze the outcomes for vulnerabilities, and present actionable recommendations to close those gaps effectively.

Staying updated on emerging cybersecurity threats requires ongoing education. I frequent industry webinars, read cybersecurity research reports, and participate in professional networks. This consistent engagement ensures that I can adapt our strategies to counteract evolving threats.