HQSEC_R037 GSIRT Service Delivery Manager

Responsibilities

GSIRT (Global Security Incident Response Team) is Sony’s global cyber defense function that delivers incident response readiness and scalable detection capabilities across Sony Group Companies (OpCos).

This team operates and governs security platforms and standards, enabling consistent monitoring and rapid response worldwide.

Position Summary

Sony is seeking a Senior Manager, GSIRT Service Delivery, to join the Global Security Incident Response Team (GSIRT). This role leads the service delivery function for GSIRT-managed security services, with a particular focus on log onboarding and operational delivery.

The position provides leadership while staying close enough to execution to ensure services are delivered effectively, consistently, and in alignment with GSIRT standards. The role works closely with Sony Group Companies (OpCos) and internal GSIRT engineering teams to enable scalable and reliable security operations.

Job Responsibilities

• Lead the GSIRT service delivery function by defining priorities, managing workload, and ensuring execution aligns with GSIRT objectives
• Manage service delivery activities for log onboarding, coordinating across GSIRT engineering teams and OpCos
• Drive critical/complex onboardings: validate log parsing/normalization, troubleshoot ingestion pipelines, and confirm data quality in the SIEM
• Perform hands-on operational deep-dives as needed (query logs, create dashboards/alerts, and refine runbooks) to unblock delivery and improve detection outcomes
• Drive automation and standardization to streamline service delivery and log onboarding (e.g., reusable onboarding templates, pipeline-as-code, data quality checks, dashboards, and Jira/ITSM workflow optimization)
• Lead engagements with Sony Group Companies to understand onboarding requirements, system environments, and operational constraints
• Oversee onboarding progress and service readiness for on‑premises, cloud (IaaS), and SaaS data sources into GSIRT platforms
• Define, monitor, and report service level objectives (SLOs), operational metrics, and key performance indicators (KPIs)
• Provide guidance to team members while remaining close enough to operations to identify delivery risks and gaps
• Drive development and improvement of service delivery processes, procedures, and documentation
• Act as an escalation point for onboarding/service delivery operational issues
• Collaborate with cyber defense, data engineering, and platform engineering teams to improve service reliability and scalability
• Perform other service delivery and cyber defense–related duties as assigned

Requirements

Required qualifications

• Experience leading or managing teams in IT, security operations, or service delivery–related disciplines
• Broad understanding of cybersecurity concepts, log management, and security operations
• Experience coordinating delivery across multiple stakeholders and technical teams
• Ability to operate in both managerial and operational contexts as needed

Preferred qualifications

• Hands-on capability to troubleshoot log ingestion/onboarding issues (e.g., data parsing, field mapping, normalization, and connectivity)
• Experience with SIEM platforms and log onboarding workflows (e.g., Splunk)
• Experience supporting or managing services used by SOC or incident response teams
• Familiarity with operational management tools such as Jira and/or ITSM platforms
• Experience working with cloud environments (AWS, Azure) in an operational context
• Strong automation mindset and experience improving operational efficiency (e.g., scripting with Python, SPL/KQL, APIs, IaC/SOAR, or building onboarding validation/monitoring tools)

Bonus system