Information Security Program Manager

Security Program Leadership & OperationsDevelops and implements client information security programs that meet business, regulatory, and industry requirementsAdvises executive leadership on information security strategy, policies, standards, and proceduresUpdates client executives on security plan progress, emerging threats, and actual or potential security incidentsDevelops and maintains security policies and procedures that govern the protection of the confidentiality, integrity, and availability of client systems and dataMonitors client security programs and environment changes to keep controls effective and risks minimizedOversees implementation of security solutions to improve overall security postureDevelops, maintains, and coordinates testing of disaster recovery and business continuity plans that reflect client system and facility needsDevelops, delivers, and monitors security awareness training programsWorks within cross-functional teams to develop and deliver secure solutionsLeads or participates in client steering committees and working groups as neededCoordinates with client security teams on incident detection, response, and resolution within agreed service-level agreements (SLAs)Risk & Compliance SupportLeads internal, vulnerability, and third-party risk assessments and supports client security auditsConducts security reviews of new and existing systems and recommends improvements to systems, policies, and proceduresEnsures appropriate administrative, technical, and physical safeguards protect client systems and informationAdvises clients on control requirements for NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable frameworks and regulationsAssesses control gaps and maturity against applicable frameworks and helps clients prioritize remediationSupports client audits, assessments, and certifications by clarifying controls, coordinating evidence, and addressing findingsDefines scope and maintains segmentation and protection controls for regulated data environments (e.g., ePHI, cardholder data, CUI)Oversees vulnerability scanning and penetration testing programs aligned with framework and regulatory requirementsMaintains cross-framework control mappings and supports compensating-control and risk-acceptance documentationWhat Makes You Stand OutCommunication ProficiencyDecision MakingProject ManagementTeamwork OrientationThoroughnessClient Relationship ManagementRegulatory Compliance ExpertiseWhat Are We Looking ForInformation Security ExperienceNote: The required qualifications may be satisfied through a combination of the experience areas listed below.At least five years of information security leadership experience, such as CISO, vCISO, or senior security leadershipAt least three years of experience in security operations, security engineering, vulnerability management, or system administrationConsulting or managed services experience supporting multiple clients across regulated industries (e.g., healthcare, financial services, government contracting)Compliance & Regulatory ExperienceAt least three years of hands-on experience implementing and operating controls for frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSSExperience serving as the security point of contact during external audits and assessments (e.g., ISO/IEC 27001, SOC 2, PCI DSS, HIPAA)Experience scoping regulated systems and data, identifying required controls, and reducing scope through data classification and network segmentationKnowledge of risk management frameworks and methodologies (e.g., NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR), with experience applying them to risk assessment, treatment, and reportingExperience with data protection technologies (encryption, tokenization, data loss prevention, secure coding)Required Training and EducationBachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related field, or equivalent work experienceRequired CertificationsMust HaveCISSP (Certified Information Systems Security Professional)Highly PreferredCISM (Certified Information Security Manager)CCSP (Certified Cloud Security Professional)CGRC (Certified in Governance, Risk and Compliance)Framework-specific credentials such as PCI ISA, HCISPP (HealthCare Information Security and Privacy Practitioner), or CMMC Certified Professional (CCP)Additional PreferredCRISC (Certified in Risk and Information Systems Control)CISA (Certified Information Systems Auditor)CIPT (Certified Information Privacy Technologist)Compensation DetailsThe potential salary range for this role is $105,000 to $120,000 per year, with eligibility for bonus or merit program. Final compensation will be based on experience, skills, market conditions, and internal equity. We offer a competitive Total Rewards program including health benefits, RRSP matching, stock option, and career development opportunities.This description does not include every duty or responsibility.

Role requirements may change based on client needs and service agreements.