Cyber Security Governance Program Manager

RELX•Philadelphia, PA

2d•$104,900 - $174,700•Hybrid

About The Position

Elsevier’s Information Security and Data Protection (ISDP) team leads the company’s cybersecurity practice, safeguarding information assets, consumer data, and technology infrastructure while fostering a security-aware culture. The team partners with business and technology stakeholders to enable effective risk management and support business objectives. Reporting to the Director of Cybersecurity Governance & Compliance, the Cybersecurity Governance Program Manager will mature Elsevier’s governance function. The role leads the development of a policy- and standards-driven governance program, defines and operationalizes the data lifecycle, redesigns the security awareness training program, and supports cybersecurity compliance certifications and related initiatives. The position works closely with technology teams, product owners, and business stakeholders across the enterprise. The role is hybrid and based in Atlanta, Georgia; Philadelphia, Pennsylvania; or London, United Kingdom. The U.S. national base pay range is $104,900–$174,700, with possible geographic differentials. The position is eligible for an annual incentive bonus.

Requirements

Extensive experience in cybersecurity governance, risk, and compliance programs.
Proven experience developing and managing security policies, standards, processes, and controls.
Experience building or maturing enterprise data governance and data protection programs.
Working knowledge of security and compliance frameworks such as ISO 27001/27701, ISO 27017/27018, ISO 42001, HIPAA, PCI DSS, NIST 800-53/800-171, FedRAMP, and GovRAMP.
Experience implementing and operating GRC platforms and security programs.
Experience designing, delivering, or modernizing security awareness and training programs, including role-based and new-hire training aligned to compliance requirements such as ISO 27001, PCI DSS, and HIPAA.
Experience planning and running phishing simulations and campaigns, and measuring program effectiveness using metrics such as completion, click, and reporting rates.
Proven project management, analytical, and problem-solving skills.

Nice To Haves

CISSP certification.
CISM certification.
CISA certification.
CHP certification.
CHSS certification.
SANS Security Awareness Professional (SSAP) certification.

Responsibilities

Lead the design and implementation of a policy- and standards-driven cybersecurity governance program supported by GRC tooling.
Establish and mature a data governance and protection program across the full data lifecycle.
Define and enforce data classification, labeling, and handling requirements, including controls to prevent inappropriate data sharing.
Establish and maintain enterprise security governance structures, roles, and accountability.
Advise business and technology stakeholders on governance, risk, and compliance matters.
Drive identification, escalation, and resolution of cybersecurity GRC risks and issues.
Support and maintain cybersecurity compliance certifications and initiatives, such as ISO, PCI, and HIPAA.
Produce metrics, KPIs, and executive-level reporting to support risk-based decision-making.
Lead the redesign of the security training program, including role-based training for developers, administrators, executives, and other high-risk roles, as well as new-hire security training.
Design, execute, and measure phishing simulations and campaigns; use results to guide targeted follow-up training and reduce human risk.