Information Security Program Manager

Mainstay Technologies, Inc. • Manchester, NH

5d • Hybrid

About The Position

The Information Security Program Manager (ISPM) serves as a strategic security advisor and primary governance lead for assigned clients. The role develops, manages, and matures client information security programs, with emphasis on CMMC, NIST compliance, risk management, governance, policy development, and assessment readiness. The ISPM works with clients, technical teams, Security Operations, external assessors, and executive leadership to align security programs with business objectives, compliance obligations, and industry best practices. The role is accountable for executing security governance activities, compliance initiatives, risk management processes, and security program outcomes.

The ISPM leads client governance meetings and reviews, develops security roadmaps, advises executives, tracks initiatives, and coordinates work across clients, technical teams, security operations, and third parties. The role leads compliance and assessment readiness activities, conducts risk assessments, maintains program documentation, and supports security operations, training, incident preparedness, and continuous improvement.

This is a full-time, salaried position with a full benefits package. The company supports flexible remote and in-office work, with weekly office attendance encouraged but not required. Because the position includes regular in-person client meetings, applicants must live within driving distance of clients, offices, and team events. Travel between offices and client sites is required.

Requirements

• Experience supporting CMMC readiness initiatives.
• Experience assisting clients through audits or certification assessments.
• Experience in consulting or managed services environments.
• Experience presenting to executive leadership teams.
• Creative problem-solving skills and the ability to synthesize multiple components into recommendations.
• Strong decision-making skills and comfort with situations that may not have a single right answer.
• Strong organization and project management skills.
• Business acumen, including understanding business processes, data flows, and system application use in varied business settings.
• Technical aptitude and the ability to understand technical concepts, tools, and the IT landscape.
• Strong written and oral communication skills, including the ability to coordinate and run successful meetings.
• A lifelong-learning mindset and eagerness to stay current with security policies and skills.
• Must live within driving distance of clients, offices, and team events.
• Ability to sit for prolonged periods and work on a computer.
• Must be able to lift 15 pounds at times.

Nice To Haves

• CISA certification.
• CISM certification.
• CMMC Certified Professional (CCP) certification.
• CISSP certification.

Responsibilities

• Serve as the primary advisor and governance lead for assigned clients.
• Lead client governance meetings and security program reviews.
• Develop and manage client security roadmaps and strategic initiatives.
• Provide security guidance to executive leadership and key stakeholders.
• Track program goals, projects, milestones, and security initiatives.
• Coordinate activities among clients, technical teams, security operations, and third-party partners.
• Present security posture, compliance status, risks, and recommendations to client leadership.
• Drive continuous improvement of client security programs.
• Serve as a subject matter expert on CMMC, NIST 800-171, HIPAA, and related security frameworks.
• Conduct compliance assessments, gap analyses, and readiness reviews.
• Interpret security, regulatory, and contractual requirements.
• Develop remediation plans to address compliance gaps.
• Guide clients through CMMC assessment preparation and readiness activities.
• Coordinate evidence collection, assessment planning, and audit support.
• Stay current on evolving compliance requirements and industry best practices, and provide compliance recommendations and implementation guidance.
• Conduct security risk assessments and program reviews.
• Maintain oversight of client risk registers and remediation activities.
• Identify, evaluate, and prioritize business, operational, and security risks.
• Develop risk treatment and mitigation recommendations.
• Facilitate risk review discussions and risk acceptance decisions.
• Provide strategic recommendations to improve security maturity and resilience.
• Support vulnerability, application, vendor, and operational risk review activities.
• Develop and maintain System Security Plans (SSP), Written Information Security Programs (WISP), Plans of Action & Milestones (POA&M), policies, procedures, standards, and governance and assessment documentation.
• Align documentation with implemented controls and compliance requirements.
• Maintain traceability between requirements, risks, controls, findings, and remediation activities.
• Review and update documentation based on regulatory, business, and technology changes.
• Support standardization and continuous improvement of security program documentation.
• Lead security awareness and compliance training initiatives.
• Facilitate tabletop exercises and security program testing.
• Oversee incident response planning and program readiness.
• Participate in significant security incidents as an advisor and coordinator.
• Conduct post-incident reviews and lessons-learned activities.
• Incorporate incidents, findings, and corrective actions into risk management and governance processes.
• Support application security reviews, vendor risk reviews, and continuous monitoring initiatives.
• Promote security best practices across client organizations.
• Travel between offices and to client sites.

Benefits

• Flexible work environment with events, lunch-and-learns, ping pong, snacks, games, and books.
• Three weeks of PTO per year, increasing to four weeks after two years.
• Two-week sabbatical after five years and five-week sabbatical after ten years.
• Health insurance.
• Dental insurance.
• Vision insurance.
• Disability insurance.
• Group and supplemental life insurance.
• Paid family leave.
• 401(k) with 3% match.
• Team profit sharing.
• Training program, including paid certifications, tuition reimbursement, and bonuses for achieving certifications.
• Paid volunteer time off.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed