Information Security Manager

LaBella Associates•Rochester, NY

3d•$105,000 - $125,000•Onsite

About The Position

LaBella is looking to hire an Information Security Manager at our Rochester, NY office. The primary responsibilities of this position are the leadership and administration of security aspects of our organization’s technology and related risk management, including the organization’s security personnel and vendors. The position is tasked with ensuring a secure workplace by planning and executing security practices using preventive measures, education, and policy as required by local laws, regulatory compliance, and best practices for the industries LaBella provides service for.

Requirements

Bachelor’s degree or higher in Cybersecurity, Information Technology, or a related field.
Certification: CISSP, CISM, or similar
Proven experience in IT security, network administration, and managing security teams.
Strong leadership skills.
Strong knowledge of network infrastructure, security tools, risk management, incident response, and compliance frameworks.
Excellent written communication skills with the ability to independently compose clear reports and directive communications to management and employees.
Excellent verbal communication skills for both one-on-one conversations and for speaking before groups.
Excellent organizational skills with attention to detail and follow-through.
Ability to work in a team environment and to communicate effectively with people at all levels within the organization.
Self-motivated to continuously seek ways to aid and improve processes.
Ability to multi-task.
An uncompromised ability to keep information confidential.
Knowledge of applicable regulatory requirements.
Team leadership and mentoring.
Data backup and recovery concepts and workflows.
Business continuity and disaster recovery continuity of operations plans.
Intrusion detection methodologies and techniques for detecting host and network-based intrusions.
Physical, logical, and policy controls related to the use, processing, storage, and transmission of data.
Policy directives on full-disk and file-level encryption technologies and encryption methods for secure exchange of data with 3rd parties.
Policy and procedural alignment with LaBella’s enterprise Information Technology (IT) goals and objectives.
Network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
Measures or indicators of system performance and availability.
Laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures for US, UK, Spain, and other similar countries and regions. GDPR experience a plus.
Familiarity with network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools and network traffic analysis methods.
In-depth knowledge of server and client operating systems.
Skill in creating policies that reflect system security objectives.
Information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures.
New and emerging information technology (IT) and cybersecurity technologies and current and emerging threats/threat vectors.
Vulnerability information dissemination sources (e.g., alerts, advisories, errata, and bulletins) and what constitutes a network attack and a network attack's relationship to both threats and vulnerabilities.
Penetration testing principles, tools, and techniques.

Nice To Haves

GDPR experience

Responsibilities

Supervise, train, and mentor security team including cybersecurity engineers, cybersecurity analysts and GRC/compliance personnel.
Develop and enforce security policies, standards, and procedures to prevent unauthorized access, loss, or destruction of company data.
Oversee policy standards and implementation strategies to ensure procedures and guidelines comply with cybersecurity policies.
Assure successful implementation and functionality of security requirements and appropriate information technology (IT) policies and procedures that are consistent with the organization's mission and goals.
Identify vulnerabilities, conduct threat assessments, and implement mitigation strategies.
Advise senior management on risk levels and security posture.
Ensure that cybersecurity requirements are integrated into the continuity planning for that system and/or organization(s).
Interpret patterns of noncompliance to determine their impact on levels of risk and/or overall effectiveness of the enterprise's cybersecurity program.
Coordinate with IT leadership to ensure cybersecurity goals align with IT goals and technology.
Monitor networks for security breaches, manage security alerts, encryption policies, and security tools, and ensure compliance with security controls.
Collect and maintain data needed to meet system cybersecurity reporting.
Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.
Lead the response to security breaches, viruses, or cyberattacks.
Supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.
Ensure compliance with legal/regulatory requirements and conduct security awareness training for staff.
Oversee the information security training and awareness program.
Support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
Continuously validate the organization against policies/guidelines/procedures/regulations/laws to ensure compliance.
Manage third-party risks by assessing vendor security protocols.
Provide system-related input on cybersecurity requirements to be included in statements of work and other appropriate procurement documents.