Information Security Lead

William Blair•Chicago, IL

22h•$120,000 - $150,000•Hybrid

About The Position

The Information Security Lead is accountable for key components of William Blair’s Information Security governance and incident response programs. Reporting to the Director of Information Security, the role independently manages the security policy framework, maturity assessments, incident response, security awareness, client and vendor due diligence, and policy exceptions. The Lead serves as the operational lead for cybersecurity incidents, maintains the Information Security roadmap, supports regulatory and audit requests, and works with stakeholders across the firm to identify and mitigate risk. The position also manages Information Security responses to regulatory and audit requests and participates in industry working groups, translating cybersecurity developments into recommended actions. The role works across a matrix organization and collaborates with technical and nontechnical stakeholders. The role is eligible for a discretionary annual bonus and/or commission-based incentives. The stated base salary range is $120,000–$150,000 USD.

Requirements

Bachelor’s and/or master’s degree in cybersecurity, information security, computer science, information systems, or a related field.
6–8 years of progressively responsible experience in information security, cybersecurity, technology risk, or security governance.
One or more relevant certifications, held or in progress: CISSP, CISM, CISA, CRISC, GSEC, GCIH, CompTIA Security+, or PMP.
Working knowledge of security governance and control frameworks, particularly the NIST Cybersecurity Framework.
Proficiency with Microsoft Office (Excel, PowerPoint, Word, Teams, SharePoint) and reporting tools such as Power BI.
Experience in financial services or another regulated industry, working across a matrix organization.
Experience using governance, risk, and compliance (GRC) platforms to document risks, controls, exceptions, incidents, and remediation.
Experience leading security governance or maturity assessment projects.
Strong analytical and risk-assessment skills, with sound judgment when managing incidents, exceptions, and material risks.
Clear written and verbal communication, including the ability to translate technical issues into business-risk language and executive-ready materials.
Strong project-management, organization, and documentation skills, with a high degree of professionalism, discretion, and attention to detail.
Ability to collaborate with technical and nontechnical stakeholders and to facilitate exercises, training, and discussions.

Responsibilities

Draft, maintain, and administer Information Security policies, standards, and guidelines aligned with the firmwide security framework, and advise stakeholders on implementation requirements and resource needs.
Lead governance maturity assessments, including NIST Cybersecurity Framework reviews for Information Security, and report status, risks, dependencies, and decisions required.
Maintain the Information Security roadmap and improvement initiatives, track progress, and escalate priority or funding decisions.
Monitor security reporting with the IT team, identify trends, and recommend risk-mitigation actions.
Administer the policy-exception process and related reporting dashboards, including Power BI.
Develop, maintain, and test incident response plans, runbooks, playbooks, and ransomware response templates.
Serve as the operational incident lead by coordinating response activities, communications, evidence, decisions, and documentation; escalate major incidents and external communications to the Director of Information Security.
Lead post-incident risk assessments and root-cause analyses and track corrective actions through completion.
Plan and lead tabletop exercises and simulations, including annual cybersecurity and ransomware, business continuity, vendor, and employee group exercises, and report outcomes and recommended improvements.
Manage the brand and executive impersonation program and support insider threat monitoring.
Manage the security awareness program, including new-hire and ongoing employee training, and use completion and results metrics to recommend program improvements.
Own the client security due diligence workflow, coordinate stakeholder review, and escalate material risk positions to the Director of Information Security.
Lead initial and ongoing vendor security assessments in partnership with the Risk Management team.
Manage Information Security responses to regulatory and audit information requests.
Participate in industry working groups and translate cybersecurity developments into recommended actions.