Information Security Manager

New York Genome Center • New York, NY

1d • $130,000 - $150,000 • Hybrid

About The Position

The Information Security Manager manages implementation and ongoing operation of the New York Genome Center’s information security program to protect clinical, research, and business information. The role coordinates security operations, risk assessments, compliance activities, policy development, and incident response across enterprise systems, cloud services, and research environments.

Working with IT, organizational leadership, and external security providers, the Manager translates security priorities into actionable plans, coordinates implementation, and reports material risks, program progress, and resource needs to leadership.

Requirements

• Bachelor’s degree in information security, computer science, or a related field, or equivalent relevant experience.
• At least 5 years of progressively responsible information security experience, including at least 2 years managing security projects, operational functions, or program components.
• Demonstrated experience applying the NIST Cybersecurity Framework to assess controls, identify gaps, prioritize improvements, and track remediation.
• Demonstrated experience with security risk assessments, incident response, vulnerability management, and third-party security risk.
• Experience authoring and revising security policies, standards, and procedures and coordinating their review and implementation.
• Experience implementing, monitoring, or coordinating security controls across identity systems, endpoints, networks, cloud services, and monitoring platforms.
• Experience coordinating technical teams and vendors and presenting actionable security recommendations to management.

Nice To Haves

• CISSP, CISM, or a comparable security certification.
• Experience in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.
• Experience supporting federally funded research or implementing contractual, sponsor, or data-use security requirements.
• Experience applying NIST SP 800-53 or SP 800-171 to applicable security obligations.
• Experience managing external security providers.

Responsibilities

• Manage the security program’s annual work plan and implementation of approved priorities.
• Author, maintain, and coordinate approval of information security policies, standards, and procedures.
• Coordinate policy implementation, employee communications, periodic reviews, and exception documentation.
• Coordinate external security service providers and monitor delivery against agreed service expectations.
• Develop security budget recommendations, evaluate proposed tools and services, and track approved expenditures.
• Maintain security metrics and report program performance, control gaps, and resource needs to leadership.
• Conduct and coordinate security risk assessments; maintain the risk register and track remediation plans.
• Apply the NIST Cybersecurity Framework to assess security capabilities, identify gaps, and recommend prioritized improvements.
• Document risk treatment recommendations and route exceptions and risk acceptance decisions to authorized leadership.
• Support applicable HIPAA Security Rule compliance activities, including risk analysis, safeguard implementation, policy documentation, and corrective actions.
• Coordinate security audits, evidence collection, control assessments, and responses to findings.
• Conduct vendor security assessments, review contractual security requirements, and respond to external security questionnaires.
• Support security obligations associated with research agreements, grants, contracts, and data-use arrangements.
• Coordinate daily security monitoring, alert escalation, vulnerability management, and remediation tracking.
• Coordinate with external monitoring providers and maintain investigation and escalation procedures.
• Coordinate vulnerability assessments and penetration testing, prioritize findings with IT and system owners, and track corrective actions to completion.
• Monitor the coverage and effectiveness of endpoint, identity, email, network, cloud, and logging controls.
• Coordinate security-tool deployment, configuration, integration, tuning, and maintenance with technical teams.
• Partner with IT and system owners on secure configurations, privileged access, access reviews, and account lifecycle controls.
• Maintain and exercise the incident response plan and supporting operational playbooks.
• Coordinate security investigations, containment, recovery, and post-incident corrective actions, escalating significant incidents to leadership.
• Maintain incident documentation and communicate findings to designated stakeholders.
• Partner with IT and operational owners on backup security, recovery planning, and exercises.
• Participate in after-hours incident response under established coverage arrangements.
• Partner with researchers, clinical teams, and IT to secure sensitive data access, storage, transfer, and collaboration.
• Review proposed systems and workflows and recommend practical security safeguards.
• Develop and deliver security awareness training, phishing education, and guidance for specialized teams.
• Communicate security requirements clearly and help stakeholders implement them.

Benefits

• Medical, dental, and vision coverage for employees and dependents.
• Vacation, holidays, sick leave, and other leave, including a paid winter break.
• 401(k) match.
• Life insurance.
• Flexible Spending Accounts.
• Employee Tuition Reimbursement.
• Employee Assistance Program.
• Additional medical, financial, and other benefits, as well as generous time off.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager