Manager, IT Security

Foley•Boston, MA

1d•Remote

About The Position

Foley is seeking a hands-on Manager of IT Security to lead security operations, strengthen the company’s security posture, and proactively identify and address risk as Foley modernizes its technology infrastructure and expands its use of AI. The role manages one security engineer while staying closely involved in technical execution. It partners with Infrastructure, Engineering, the AI team, and business stakeholders to protect Foley while enabling innovation. The position leads security improvements across AWS and identity systems; maintains endpoint security, patching, EDR coverage, and security monitoring; and owns vulnerability management and incident response. It also partners with AI and Engineering teams to secure AI tools, agents, integrations, and development environments. The manager owns Foley’s SOC 2 Type II audit process, maintains PCI DSS requirements, supports security policies and vendor risk assessments, and develops a prioritized security roadmap with the Director of Infrastructure. The role is primarily remote within the United States, works primarily EST hours, and requires occasional office visits for collaboration, training, or company events. It may be based remotely in the states listed in the posting.

Requirements

At least 7 years of information security experience, including experience leading security initiatives or programs and managing or formally leading security professionals.
Strong hands-on AWS security experience, including IAM, multi-account governance, network security, and AWS-native security services such as GuardDuty, Security Hub, and CloudTrail.
Deep experience with Microsoft Entra ID, Conditional Access, SSO/federation, privileged access, and identity lifecycle management.
Demonstrated experience with endpoint security, vulnerability management, incident response, and MDR/SOC partnerships.
Proven experience owning SOC 2 Type II audits end to end, including control implementation, evidence collection, audit coordination, and remediation.
Working knowledge of AI security risks, including data leakage, over-privileged agents, non-human identities, and secure AI integrations.
Proactive approach to identifying risks, recommending solutions, and independently driving improvements.
Strong communication skills across technical and business audiences.

Nice To Haves

Experience with PCI DSS and security frameworks such as NIST CSF, ISO 27001, and CIS Controls.
Relevant certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft SC-series.
Scripting, automation, or infrastructure-as-code experience.
Experience securing a distributed workforce in a lean or regulated environment.

Responsibilities

Lead security improvements across AWS, including IAM, multi-account governance, networking, and security monitoring.
Manage identity and access controls through Microsoft Entra ID, Conditional Access, SSO/SCIM, and privileged access management.
Maintain and strengthen endpoint security, patching, EDR coverage, and security monitoring across the managed fleet.
Optimize security tools, including Rapid7, Intune, NinjaOne, and related platforms.
Own vulnerability management from detection and prioritization through remediation.
Lead incident response, coordinate with the MDR provider, and drive corrective actions that reduce future risk.
Partner with AI and Engineering teams to secure AI tools, agents, and integrations, including practical guardrails for data protection, access permissions, non-human identities, and responsible AI adoption.
Own the SOC 2 Type II audit process end to end, including security controls, evidence collection, audit readiness, remediation, and coordination with external auditors.
Maintain PCI DSS compliance requirements and support security policies and vendor risk assessments.
Partner with Engineering to strengthen security across development environments, CI/CD pipelines, source control, and application integrations.
Monitor emerging threats, evaluate security risks, and drive security improvements.
Develop and execute a prioritized security roadmap in partnership with the Director of Infrastructure.
Manage and develop a security engineer and collaborate with Infrastructure, Engineering, Compliance, Legal, and business teams.