Manager, IT Security

Foley•Boston, MA

2d•$110,000 - $150,000•Remote

About The Position

Foley is seeking a hands-on Manager of IT Security to lead security operations, strengthen its security posture, and identify and address risks as the company modernizes its technology infrastructure and expands its use of AI. The role manages one security engineer while remaining closely involved in technical execution. It calls for initiative, clear recommendations, and ownership of security improvements through completion. The manager partners with Infrastructure, Engineering, the AI team, and business stakeholders to protect Foley while enabling innovation. Responsibilities span AWS and identity security, endpoint protection and security operations, vulnerability management and incident response, AI security, SOC 2 Type II and PCI DSS compliance, secure engineering, and development of a prioritized security roadmap in partnership with the Director of Infrastructure. The role is primarily remote within the United States, primarily aligned to EST hours, with occasional office visits for collaboration, training, or company events. Remote work is available from the listed states in the posting.

Requirements

7+ years of information security experience, including leading security initiatives or programs and managing or formally leading security professionals.
Strong hands-on AWS security experience, including IAM, multi-account governance, network security, and AWS-native security services such as GuardDuty, Security Hub, and CloudTrail.
Deep experience with Microsoft Entra ID, Conditional Access, SSO/federation, privileged access, and identity lifecycle management.
Demonstrated experience with endpoint security, vulnerability management, incident response, and MDR/SOC partnerships.
Proven experience owning SOC 2 Type II audits end to end, including control implementation, evidence collection, audit coordination, and remediation.
Working knowledge of AI security risks, including data leakage, over-privileged agents, non-human identities, and secure AI integrations.
Proactive approach to identifying risks, recommending solutions, and independently driving improvements.
Strong communication skills with technical and business audiences.

Nice To Haves

Experience with PCI DSS and security frameworks such as NIST CSF, ISO 27001, and CIS Controls.
Relevant certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft SC-series.
Scripting, automation, or infrastructure-as-code experience.
Experience securing a distributed workforce in a lean or regulated environment.

Responsibilities

Lead AWS security improvements across IAM, multi-account governance, networking, and security monitoring.
Manage identity and access controls through Microsoft Entra ID, Conditional Access, SSO/SCIM, and privileged access management.
Maintain and strengthen endpoint security, patching, EDR coverage, and security monitoring across the managed fleet.
Optimize security tools, including Rapid7, Intune, NinjaOne, and related platforms.
Own vulnerability management from detection and prioritization through remediation.
Lead incident response, coordinate with the MDR provider, and drive corrective actions to reduce future risk.
Partner with AI and Engineering teams to secure AI tools, agents, and integrations, and implement practical guardrails for data protection, access permissions, non-human identities, and responsible AI adoption.
Own Foley's SOC 2 Type II audit process end to end, including security controls, evidence collection, audit readiness, remediation, and coordination with external auditors.
Maintain PCI DSS requirements and support security policies and vendor risk assessments.
Partner with Engineering to strengthen security across development environments, CI/CD pipelines, source control, and application integrations.
Monitor emerging threats, evaluate security risks, and develop and execute a prioritized security roadmap in partnership with the Director of Infrastructure.
Manage and develop a security engineer and collaborate with Infrastructure, Engineering, Compliance, Legal, and business teams.