Information Security Manager
About The Position
The Information Security Manager will work across governance, audits, and risk as part of a small Information Security & Compliance team. This hands-on role owns day-to-day compliance processes, including audit coordination, policy governance, enterprise security risk management, and vendor risk assessments. The position also supports GRC tooling selection and setup, security awareness training, customer questionnaires, and incident response. The manager partners with CloudOps, IT, Dev, engineering, and business stakeholders, reporting program health and explaining risks in clear terms. The role mentors a junior teammate and works closely with the VP of Information Security & Compliance, with an opportunity to grow into broader security leadership. The company serves large utilities and energy companies whose regulated assets run on its SaaS platform. This is a hybrid role combining work from the corporate office and home. Onsite work may be required for scheduled office days, team or client meetings, and special events.
Requirements
- Eight or more years of experience in cybersecurity compliance, audit, or risk management.
- Experience in the SaaS industry and sufficient understanding of software and cloud environments to discuss risk with engineers.
- Experience facilitating audits such as SOC 2, ISO 27001, or NIST CSF 2.0; FedRAMP experience also counts.
- Ability to communicate across security domains and explain the significance of risks to engineers and executives.
- Comfort working across a broad range of responsibilities; experience in a smaller organization covering multiple areas or deep governance expertise in a larger organization is suitable.
Responsibilities
- Facilitate SOC 1, SOC 2, and other external audits from scoping through fieldwork, ensuring evidence is delivered on time and audit readiness is maintained year-round.
- Own information security policy governance, including policy ownership, review cadence, and audit-ready records.
- Run the enterprise security risk program, ensuring each risk has an owner, plan, and date, and explaining risks in clear security and SaaS terms.
- Manage vendor risk assessments.
- Help select and implement GRC tools such as Drata, Vanta, Full Circle, or UpGuard.
- Report program health to leadership and partner with CloudOps, IT, and Dev.
- Support security awareness training, customer questionnaires, and incident response.
- Mentor a junior teammate and help shape the team's growth.
Benefits
- Flexible working arrangements when sensible
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Manager
Education Level
No Education Listed
