Information Security Manager

Sotheby's

About The Position

As an Information Security Manager, you will be responsible for executing major components of Sotheby’s information security strategy, as well as helping to define it. Reporting directly to the CISO, you will be the driving force behind accomplishing key initiatives, while working closely with managers across the globe to balance achieving business objectives with managing risk. Rather than being confined to a narrow role, you will be a utility player, moving between different areas as needed, for example: performing risk assessments and security reviews, procuring infosec tools, managing projects, drafting policies and processes, conducting risk management meetings, designing controls, overseeing auditors, and leading incident response. And as a key part of a team dedicated to continuous improvement, you will help us get better every day. You obsess over getting the key facts nailed down. You have an attention to detail that some might call “extreme”. And you recognize the daunting challenge of managing information security at a historic and globally recognized brand, but that challenge excites you.

Requirements

At least five years of hands-on experience in information security roles
Bachelor's or Master’s in computer science, engineering, or cybersecurity
Deep understanding of information security fundamentals
Proven ability to manage complex projects from conception to completion
Ability to explain complex technical risks in simple, business-friendly language
Ability to communicate clearly, precisely, and concisely

Nice To Haves

At least one active credential, such as CISA, CRISC, CISM, or CISSP
Experience performing risk assessments across diverse systems including SaaS and mobile
Deep knowledge of frameworks and standards such as CIS, ISO 27001, and NIST
Experience leading incident response through a cyberattack or data breach

Responsibilities

Work with IT and business unit managers to drive security initiatives to completion
Lead business continuity and disaster recovery planning and preparation projects
Lead internal and external security audits, acting as the primary point of contact for auditors
Draft, update, and enforce information security policies, processes, and standards
Conduct third-party vendor risk assessments and internal security risk assessments
Maintain risk registers, compliance dashboards, and reports for senior leadership
Audit internal systems to verify compliance with mandatory security controls
Develop policies, processes, and risk assessments aligned to top frameworks such as CIS, NIST, ISO 27001, and SOC 2
Crosswalk and harmonize controls across multiple compliance frameworks
Document security requirements, support control implementation, and help track remediation progress
Build risk registers, support assessments, and monitor remediation progress
Plan, lead, and execute control validation and testing activities across various domains (e.g., access management, vulnerability management, incident response, data protection)
Mentor junior analysts and engineers, providing guidance on control validation methodologies and best practices while fostering a culture of accountability
Document control issues and collaborate with stakeholders to develop remediation recommendations
Develop and enhance control testing methodologies, procedures, and reporting mechanisms