Senior Manager, Security Engineering

About the Team:

Security Operations & Engineering protects Morningstar’s corporate environment, products, and the cloud platforms behind them. The group includes two distinct teams: the 24x7 Security Operations Center, and Security Engineering, which this role leads.

Security Engineering owns the tooling that makes detection, response, and prevention possible, including NGAV/EDR, email security, SOAR, detection engineering, and CSPM. Because Morningstar builds its software in house, we also provide the security foundations product development teams build on, such as security scanning in pipelines, hardened container images, and library integrations. We work closely with product engineering and product security teams to make the secure path the easy one, and we focus on the platforms, tooling, and guardrails that let security scale.

The Role:

Lead the Security Engineering team that owns the tooling behind Morningstar’s security program, including endpoint protection, email security, SOAR, detection engineering, and cloud security posture management. You’ll set the team’s priorities, grow its engineers, and make sure the platforms they run give the SOC and the business the visibility, automation, and protection they need. You’ll also guide the shared security foundations that product teams build on, like pipeline scanning, hardened container images, and library integrations. Reporting to the Director of Security Operations & Engineering, you’ll coach your team and stay close enough to the work to help solve difficult technical problems. You’ll have room to shape how engineering and incident response work together, with direct access to security leadership and product development teams.

This on-site role is based in Chicago, IL. It may be filled at the Manager or Senior Manager level, depending on your experience and prior leadership scope. You’ll participate in an infrequent, emergency-only escalation rotation outside normal business hours.

What you’ll be doing:

• Lead and develop security engineers and the incident response lead. Set clear expectations, plan workloads, and support hiring, performance management, and career growth.
• Own the engineering roadmap for detection and security platforms, balancing operational needs with architecture, platform health, and technical debt. The stack includes Splunk, CrowdStrike, Wiz and Wiz Defend, and Zscaler.
• Work with the 24x7 SOC to improve detections and playbooks, automate manual work with XSOAR or Tines, and apply AI where it can improve detection, triage, and response. Track detection quality, automation coverage, and response performance; explain progress and risk to senior leaders.
• Help the incident response lead handle complex investigations and containment. Make sure responders have the tools and support they need, turn lessons learned into engineering improvements, and troubleshoot alongside engineers when they are blocked.
• Partner with product development, cloud platform, and infrastructure teams to strengthen security across AWS, GCP, and Azure while supporting product delivery.
• Integrate automated security checks into product teams’ CI/CD pipelines, including Harness. Help secure agentic and AI-assisted development pipelines, where autonomous tools write, test, and deploy code.

What we’re looking for:

• 4+ years of people management experience, or equivalent technical leadership experience, in security engineering or security operations, with examples of developing people and delivering engineering work.
• Hands-on security engineering knowledge and the ability to troubleshoot complex problems with your team. Experience with SIEM, endpoint detection and response, cloud security posture management, and security automation or orchestration is required; comparable tools are welcome.
• Cloud security experience in a large, multi-cloud environment, ideally including AWS at scale, plus knowledge of incident investigation, containment, and post-incident improvement.
• Sound technical judgment and clear communication with engineers, analysts, and senior leaders, including colleagues in globally distributed teams.
• CI/CD security experience is a plus, including static application security testing (SAST), software composition analysis (SCA), secrets scanning, and infrastructure-as-code (IaC) scanning. CISSP, CISM, or GIAC certifications are welcome, not required

Compensation and Benefits

At Morningstar we believe people are at their best when they are at their healthiest. That’s why we champion your wellness through a wide range of programs that support all stages of your personal and professional life. Here are some examples of the offerings we provide:

• Financial Health

  • 100% 401k match up to 6% of salary

  • Stock Ownership Potential

  • Company provided life insurance - 1x salary + commission

• Physical Health

  • Comprehensive health benefits (medical/dental/vision) including potential premium discounts and company-provided HSA contributions (up to $500-$2,000 annually) for specific plans and coverages

  • Additional medical Wellness Incentives - up to $300-$600 annual

  • Company-provided long- and short-term disability insurance

• Emotional Health

  • Trust-Based Time Off

  • 6-week Paid Sabbatical Program

  • 6-Week Paid Family Caregiving Leave

  • Competitive 8-24 Week Paid Parental Leave

  • Adoption Assistance

  • Leadership Coaching & Formal Mentorship Opportunities

  • Annual Flex Stipend - $1000 annually to cover personal education & well-being expenses

  • Tuition Reimbursement

• Social Health

  • Charitable Matching Gifts program

  • Dollars for Doers volunteer program

  • Paid volunteering days

  • 15+ Employee Resource & Affinity Groups

Total Cash Compensation Range

Inclusive of annual base salary and target incentive

Morningstar's hybrid work environment gives you the opportunity to collaborate in-person each week as we've found that we're at our best when we're purposely together on a regular basis. In most of our locations, our hybrid work model is four days in-office each week. A range of other benefits are also available to enhance flexibility as needs change. No matter where you are, you'll have tools and resources to engage meaningfully with your global colleagues.