Cyber Security & Risk Manager

Surf Internet•Elkhart, IN

23h•$110,000 - $130,000•Onsite

About The Position

The Cybersecurity & Risk Manager is a hands-on leader responsible for developing, implementing, and continuously improving the organization's cybersecurity and risk management program. This role serves as the primary cybersecurity subject matter expert, driving strategic security initiatives while actively managing daily security operations, incident response, vulnerability management, compliance activities, vendor risk assessments, and security awareness programs. The manager partners across the organization to identify and mitigate risk, align security practices with business objectives, and mature the cybersecurity program using the NIST Cybersecurity Framework (CSF) and other applicable industry standards. As the organization's security leader, this individual provides guidance to leadership, supports protection of critical business and network infrastructure, and champions a culture of security throughout the enterprise. The position is in the IT department, is exempt, and reports to the Chief Information Officer. It is located at the Elkhart Corporate office in Elkhart, Indiana. The listed salary range is $110,000 to $130,000, and travel is not required.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field.
At least 5 years of progressive cybersecurity experience, with demonstrated ability to independently manage cybersecurity initiatives, risk management activities, and security operations.
Strong technical skills in SIEM, EDR, vulnerability scanning, and cloud security tools.
Strong understanding and practical application of the NIST Cybersecurity Framework (CSF), including framework assessments, gap analysis, control implementation, and cybersecurity maturity planning.
Experience developing security metrics, risk registers, policies, standards, and executive-level reporting.
Excellent written and verbal communication skills and a problem-solving mindset.
Experience with agile methodologies and a collaborative work approach.

Nice To Haves

Certifications such as CISSP, CISM, or Security+ are highly desirable.

Responsibilities

Monitor security alerts, logs, and events daily; investigate and respond to threats and anomalies in real time.
Track and refine cybersecurity KPIs to support trend analysis, improvements, and leadership reporting aligned with regulatory goals.
Lead all phases of incident response; maintain and improve the Incident Response Playbook; and ensure accurate documentation and preventive actions through structured tracking and analysis.
Draft, maintain, and enforce security policies; ensure accessibility and cross-department compliance, with corrective actions where needed.
Analyze third-party scan reports, maintain a vulnerability inventory, and coordinate remediation efforts with stakeholders within defined SLAs.
Deliver and track security awareness programs and phishing simulations, adjusting content based on performance and emerging threats.
Manage a repeat offender remediation program for users who repeatedly fail phishing simulations, including targeted training, awareness reinforcement, performance tracking, and coordination with management when necessary.
Maintain and update the organization's Information Security Risk Register, ensuring timely tracking, ownership, and mitigation of identified risks.
Coordinate annual enterprise cybersecurity risk and NIST maturity assessments with third-party security partners; document findings, evaluate business impact, and track remediation activities through resolution.
Develop and monitor risk treatment plans to ensure identified risks are mitigated, transferred, accepted, or avoided according to organizational risk tolerance.
Drive security initiatives, tool deployments, and improvements by tracking milestones, coordinating vendors, and reporting status to leadership.
Coordinate tabletop exercises with third-party facilitators; document results and follow-up actions to enhance preparedness.
Collaborate with external providers to maintain, test, and update business continuity and disaster recovery plans; support internal drills and escalate identified risks.
Manage vendor risk assessments, track remediation of findings, and ensure due diligence during onboarding and renewals.
Develop and maintain the organization's cybersecurity strategy, roadmap, security initiatives, and governance standards aligned with business objectives and organizational risk.
Provide regular cybersecurity risk, compliance, and program maturity updates and recommendations to executive leadership.
Evaluate emerging threats, technologies, and regulatory requirements, recommending and prioritizing investments and remediation efforts accordingly.
Serve as the organization's primary cybersecurity advisor, providing guidance on business, technology, infrastructure, cloud, and third-party solution decisions.