Information Security Program Manager

Harris Computer•Remote - Florida, ON

1d•$105,000 - $120,000

About The Position

The Information Security Program Manager develops and implements client information security programs aligned with business, regulatory, and industry requirements. The role advises executive leadership on security strategy, policies, standards, and procedures; tracks program progress and emerging threats; and oversees security solutions, continuity planning, awareness training, and incident coordination. It works with cross-functional teams and client security teams to maintain effective controls and protect the confidentiality, integrity, and availability of client systems and data. The role leads risk assessments and supports audits, assessments, and certifications. It reviews systems and controls, advises clients on requirements across applicable frameworks and regulations, identifies control gaps, and helps prioritize remediation. It also defines the scope and protection of regulated data environments, oversees vulnerability scanning and penetration testing, and maintains cross-framework control mappings and risk documentation.

Requirements

At least five years of information security leadership experience, such as CISO, vCISO, or senior security leadership; qualifications may be satisfied through a combination of the listed experience areas.
At least three years of experience in security operations, security engineering, vulnerability management, or system administration.
Consulting or managed services experience supporting multiple clients across regulated industries, such as healthcare, financial services, or government contracting.
At least three years of hands-on experience implementing and operating controls for frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS.
Experience serving as the security point of contact during external audits and assessments, such as ISO/IEC 27001, SOC 2, PCI DSS, or HIPAA.
Experience scoping regulated systems and data, identifying required controls, and reducing scope through data classification and network segmentation.
Knowledge of risk management frameworks and methodologies, such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR, with experience applying them to risk assessment, treatment, and reporting.
Experience with data protection technologies, including encryption, tokenization, data loss prevention, and secure coding.
Bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related field, or equivalent work experience.
CISSP (Certified Information Systems Security Professional) certification.

Nice To Haves

CISM (Certified Information Security Manager).
CCSP (Certified Cloud Security Professional).
CGRC (Certified in Governance, Risk and Compliance).
Framework-specific credentials such as PCI ISA, HCISPP (HealthCare Information Security and Privacy Practitioner), or CMMC Certified Professional (CCP).
CRISC (Certified in Risk and Information Systems Control).
CISA (Certified Information Systems Auditor).
CIPT (Certified Information Privacy Technologist).
Communication proficiency.
Decision-making ability.
Project management skills.
Teamwork orientation.
Thoroughness.
Client relationship management skills.
Regulatory compliance expertise.

Responsibilities

Develop and implement client information security programs that meet business, regulatory, and industry requirements.
Advise executive leadership on information security strategy, policies, standards, and procedures.
Update client executives on security plan progress, emerging threats, and actual or potential security incidents.
Develop and maintain security policies and procedures protecting the confidentiality, integrity, and availability of client systems and data.
Monitor client security programs and environmental changes to keep controls effective and risks minimized.
Oversee implementation of security solutions to improve security posture.
Develop, maintain, and coordinate testing of disaster recovery and business continuity plans suited to client systems and facilities.
Develop, deliver, and monitor security awareness training programs.
Work with cross-functional teams to develop and deliver secure solutions.
Lead or participate in client steering committees and working groups as needed.
Coordinate with client security teams on incident detection, response, and resolution within agreed service-level agreements.
Lead internal, vulnerability, and third-party risk assessments and support client security audits.
Conduct security reviews of new and existing systems and recommend improvements to systems, policies, and procedures.
Ensure appropriate administrative, technical, and physical safeguards protect client systems and information.
Advise clients on control requirements for applicable frameworks and regulations, including NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, and PCI DSS.
Assess control gaps and maturity against applicable frameworks and help clients prioritize remediation.
Support client audits, assessments, and certifications by clarifying controls, coordinating evidence, and addressing findings.
Define scope and maintain segmentation and protection controls for regulated data environments, such as ePHI, cardholder data, and CUI.
Oversee vulnerability scanning and penetration testing programs aligned with framework and regulatory requirements.
Maintain cross-framework control mappings and support compensating-control and risk-acceptance documentation.