Information Security Program Manager

Job summary

The Information Security Program Manager will lead and implement client security programs while advising executive leadership on security strategy and risk management. They will also oversee security operations, manage compliance audits, and coordinate incident response efforts across cross-functional teams.

Job details

WHAT YOU WILL DO Security Program Leadership & Operations Develops and implements client information security programs that meet business, regulatory, and industry requirements Advises executive leadership on information security strategy, policies, standards, and procedures Updates client executives on security plan progress, emerging threats, and actual or potential security incidents Develops and maintains security policies and procedures that govern the protection of the confidentiality, integrity, and availability of client systems and data Monitors client security programs and environment changes to keep controls effective and risks minimized Oversees implementation of security solutions to improve overall security posture Develops, maintains, and coordinates testing of disaster recovery and business continuity plans that reflect client system and facility needs Develops, delivers, and monitors security awareness training programs Works within cross-functional teams to develop and deliver secure solutions Leads or participates in client steering committees and working groups as needed Coordinates with client security teams on incident detection, response, and resolution within agreed service-level agreements (SLAs) Risk & Compliance Support Leads internal, vulnerability, and third-party risk assessments and supports client security audits Conducts security reviews of new and existing systems and recommends improvements to systems, policies, and procedures Ensures appropriate administrative, technical, and physical safeguards protect client systems and information Advises clients on control requirements for NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable frameworks and regulations Assesses control gaps and maturity against applicable frameworks and helps clients prioritize remediation Supports client audits, assessments, and certifications by clarifying controls, coordinating evidence, and addressing findings Defines scope and maintains segmentation and protection controls for regulated data environments (e.g., ePHI, cardholder data, CUI) Oversees vulnerability scanning and penetration testing programs aligned with framework and regulatory requirements Maintains cross-framework control mappings and supports compensating-control and risk-acceptance documentation WHAT MAKES YOU STAND OUT Communication Proficiency Decision Making Project Management Teamwork Orientation Thoroughness Client Relationship Management Regulatory Compliance Expertise WHAT ARE WE LOOKING FOR Information Security Experience Note: The required qualifications may be satisfied through a combination of the experience areas listed below. At least five years of information security leadership experience, such as CISO, vCISO, or senior security leadership At least three years of experience in security operations, security engineering, vulnerability management, or system administration Consulting or managed services experience supporting multiple clients across regulated industries (e.g., healthcare, financial services, government contracting) Compliance & Regulatory Experience At least three years of hands-on experience implementing and operating controls for frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS Experience serving as the security point of contact during external audits and assessments (e.g., ISO/IEC 27001, SOC 2, PCI DSS, HIPAA) Experience scoping regulated systems and data, identifying required controls, and reducing scope through data classification and network segmentation Knowledge of risk management frameworks and methodologies (e.g., NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR), with experience applying them to risk assessment, treatment, and reporting Experience with data protection technologies (encryption, tokenization, data loss prevention, secure coding) Required Training and Education Bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related field, or equivalent work experience Required Certifications Must Have CISSP (Certified Information Systems Security Professional) Highly Preferred CISM (Certified Information Security Manager) CCSP (Certified Cloud Security Professional) CGRC (Certified in Governance, Risk and Compliance) Framework-specific credentials such as PCI ISA, HCISPP (HealthCare Information Security and Privacy Practitioner), or CMMC Certified Professional (CCP) Additional Preferred CRISC (Certified in Risk and Information Systems Control) CISA (Certified Information Systems Auditor) CIPT (Certified Information Privacy Technologist) COMPENSATION DETAILS The potential salary range for this role is $105,000 to $120,000 per year, with eligibility for bonus or merit program. Final compensation will be based on experience, skills, market conditions, and internal equity. We offer a competitive Total Rewards program including health benefits, RRSP matching, stock option, and career development opportunities. This description does not include every duty or responsibility. Role requirements may change based on client needs and service agreements.

What you’ll do

The Information Security Program Manager will lead and implement client security programs while advising executive leadership on security strategy and risk management. They will also oversee security operations, manage compliance audits, and coordinate incident response efforts across cross-functional teams.

Requirements

Candidates must have at least five years of security leadership experience and a strong background in regulatory frameworks like NIST, ISO, and HIPAA. A bachelor's degree and a CISSP certification are required, with additional certifications like CISM or CCSP highly preferred.

Benefits

• Health benefits
• RRSP matching
• Stock option
• Career development opportunities

Listed skills

• Compliance · Preferred
• Risk Management · Preferred
• Project management · Preferred
• Client Relationship Management · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Information security leadership
• Security operations
• Vulnerability management
• Risk management
• Compliance
• NIST CSF
• ISO/IEC 27001
• HIPAA
• SOC 2
• PCI DSS
• Disaster recovery
• Business continuity
• Security awareness training
• Incident response
• Project management
• Client relationship management
• Certified Information System Auditor (CISA)
• Client Security
• HealthCare Information Security And Privacy Practitioner (HCISPP)
• Certified Cloud Security Professional (CCSP)
• Security Solutions
• NIST Cybersecurity Framework (CSF)
• NIST 800
• Penetration Testing
• Auditing
• Customer Relationship Management
• Business Continuity Planning
• Certified Information Systems Security Professional
• Certified Information Security Manager
• Decision Making
• Communication
• Regulatory Compliance
• Computer Science
• Information Systems
• Confidentiality
• Consulting
• Certified In Risk And Information Systems Control
• Data Loss Prevention
• Information Privacy
• Encryption
• System Administration
• Disaster Recovery
• External Auditing
• Financial Services
• Governance
• Government Contracting
• Leadership
• Health Insurance Portability And Accountability Act (HIPAA) Compliance
• Security Engineering
• ISO 31000 Series

Job areas

• Security & Safety
• Technology
• Management & Leadership
• Consulting
• Information Security Program Manager
• Cyber Security Manager / Administrator
• Database and Network Professionals Not Elsewhere Classified
• Information Security Engineers
• Computer Occupations, All Other

More jobs from Harris Computer