Information Security Program Manager

WHAT YOU WILL DO

Security Program Leadership & Operations

• Develops and implements client information security programs that meet business, regulatory, and industry requirements
• Advises executive leadership on information security strategy, policies, standards, and procedures
• Updates client executives on security plan progress, emerging threats, and actual or potential security incidents
• Develops and maintains security policies and procedures that govern the protection of the confidentiality, integrity, and availability of client systems and data
• Monitors client security programs and environment changes to keep controls effective and risks minimized
• Oversees implementation of security solutions to improve overall security posture
• Develops, maintains, and coordinates testing of disaster recovery and business continuity plans that reflect client system and facility needs
• Develops, delivers, and monitors security awareness training programs
• Works within cross-functional teams to develop and deliver secure solutions
• Leads or participates in client steering committees and working groups as needed
• Coordinates with client security teams on incident detection, response, and resolution within agreed service-level agreements (SLAs)

Risk & Compliance Support

• Leads internal, vulnerability, and third-party risk assessments and supports client security audits
• Conducts security reviews of new and existing systems and recommends improvements to systems, policies, and procedures
• Ensures appropriate administrative, technical, and physical safeguards protect client systems and information
• Advises clients on control requirements for NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable frameworks and regulations
• Assesses control gaps and maturity against applicable frameworks and helps clients prioritize remediation
• Supports client audits, assessments, and certifications by clarifying controls, coordinating evidence, and addressing findings
• Defines scope and maintains segmentation and protection controls for regulated data environments (e.g., ePHI, cardholder data, CUI)
• Oversees vulnerability scanning and penetration testing programs aligned with framework and regulatory requirements
• Maintains cross-framework control mappings and supports compensating-control and risk-acceptance documentation

WHAT MAKES YOU STAND OUT

• Communication Proficiency
• Decision Making
• Project Management
• Teamwork Orientation
• Thoroughness
• Client Relationship Management
• Regulatory Compliance Expertise

WHAT ARE WE LOOKING FOR

Information Security Experience

• At least five years of information security leadership experience, such as CISO, vCISO, or senior security leadership
• At least three years of experience in security operations, security engineering, vulnerability management, or system administration
• Consulting or managed services experience supporting multiple clients across regulated industries (e.g., healthcare, financial services, government contracting)

Compliance & Regulatory Experience

• At least three years of hands-on experience implementing and operating controls for frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS
• Experience serving as the security point of contact during external audits and assessments (e.g., ISO/IEC 27001, SOC 2, PCI DSS, HIPAA)
• Experience scoping regulated systems and data, identifying required controls, and reducing scope through data classification and network segmentation
• Knowledge of risk management frameworks and methodologies (e.g., NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR), with experience applying them to risk assessment, treatment, and reporting
• Experience with data protection technologies (encryption, tokenization, data loss prevention, secure coding)

Required Training and Education

• Bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related field, or equivalent work experience

Required Certifications

Must Have

• CISSP (Certified Information Systems Security Professional)

Highly Preferred

• CISM (Certified Information Security Manager)
• CCSP (Certified Cloud Security Professional)
• CGRC (Certified in Governance, Risk and Compliance)
• Framework-specific credentials such as PCI ISA, HCISPP (HealthCare Information Security and Privacy Practitioner), or CMMC Certified Professional (CCP)

Additional Preferred

• CRISC (Certified in Risk and Information Systems Control)
• CISA (Certified Information Systems Auditor)
• CIPT (Certified Information Privacy Technologist)

COMPENSATION DETAILS

The potential salary range for this role is $105,000 to $120,000 per year, with eligibility for bonus or merit program. Final compensation will be based on experience, skills, market conditions, and internal equity. We offer a competitive Total Rewards program including health benefits, RRSP matching, stock option, and career development opportunities.