Finance Manager - Shared Services

The Senior Identity Threat Detection & Response (ITDR) Analyst will play a critical role in proactively identifying, monitoring, and remediating identity-related risks across Mattel's enterprise. This position is responsible for analyzing identity and access logs, detecting anomalies, investigating suspicious activities, and ensuring protective controls such as MFA and Zero Trust policies are consistently enforced.

As senior analysts, they serve as daily owners of ITDR monitoring, ensuring risks are addressed before threat actors can exploit them. Working closely with IAM Engineers, PAM Engineers, and Security Operations, the Sr. ITDR Analyst will strengthen Mattel's identity defenses by leveraging tools such as CrowdStrike ITP, Okta logging and reporting,SemperisDSP, SIEM platforms,and related monitoringor reportingsolutions.

Objectives of this Role

• Monitor and analyze identity-related logs and alerts fromCrowdStrike ITP, Okta,SemperisDSP, SIEM platforms (Splunk, Sumo Logic, ELK, etc.), and other security tools.

• Detect, investigate, and respond to suspicious identity events such as anomalous logins, privilege escalations, and MFA bypass attempts.

• EnsureMFA enforcementacross all accounts;identifyaccounts lacking MFA andtake action to remediateor block them.

• Collaborate with IAM and PAM teams to strengthen access controls, privileged account monitoring, and compliance with Zero Trust standards.

• Supportincidentresponsefor identity-related threats, including containment, remediation, and root cause analysis.

• Contribute todisaster recovery, threat hunting, and risk remediationefforts within identity and access ecosystems.

• Develop,maintainand improve ITDRIAM\PAMdashboards, reports, and metrics for leadership visibility and audit readiness.

• Create andmaintainrunbooks, playbooks, and workflowsto ensure operational consistency.

• Provide escalation support for IAM Engineers and PAM Engineers in identity-related security incidents.

• Additionalduties may be assigned as necessary to meet the ongoing needs of the organization.

• Work hours may vary, and the position may require availabilityduring off-business hoursas dictated by project needs, system changes, or security events.

• 5+ years of experience in cybersecurity or identity security, with 3+ years focused on identity threat detection and response.

• Hands-on experience monitoring and analyzing events from CrowdStrike ITP, Okta logs/reports,SemperisDSP, and SIEM solutions (Splunk, Sumo Logic)and other tools.

• Proven ability to detect and remediate identity risks before they escalate into incidents.

• Expertisein enforcing MFA, Zero Trust, JIT access,passwordless,and privileged monitoring controls.

• Strong understanding of Active Directory/LDAP,Entra ID(Azure AD), Okta Identity Cloud,andPAM solutions (e.g.CyberArk, Okta OPA,BeyondTrust,Delinea,Cerby).

• Experience supporting incident management, disaster recovery, and risk remediation in enterprise identity environments.

• Skilled in analyzing authentication events, account lifecycle anomalies, and privileged account activity.

• Familiarity with compliance requirements (SOX, PCI, NIST) and ability to produce audit-ready evidence.

• Strong communication, collaboration, and analytical skills, withabilityto work across IAM, PAM, and security operations teams.

• Experience developing operational dashboards, metrics, and reporting using Security Information and Event Management (SIEM) and other tools (e.g.Grafana, Sumo Logic, CrowdStrike ITP etc.) to track IAM/PAM/ITDR effectiveness and risk.

• Advanced Microsoft Excel, including pivot tables, formulas, and data analysis.

• Participate in after-hoursrotations or on-call duties to support critical incidentresponseas needed.

Preferred:

• Bachelor's degree in technology or applicable experience.

• CISSP, CISMP certification, or other security certifications.

• Okta Certified Administrator, Okta Consultant, or equivalent IAM certification.

• Experience withrisk analysis inothercloud IAM solutions (e.g.AWS Cognito, Azure AD, GCP IAM).

• Experience in threat hunting and red/blue team collaboration.

• Knowledge of risk scoring models, behavioral analytics, and identity threat intelligence.

• Familiarity with Grafana or other visualization tools for threat metrics and dashboards.

• Proficiencyin scripting and automation (PowerShell,VBScript,Python, REST APIs) to enhance detection and response.