Security and Privacy Manager

EHE Health•New York, NY

3d•$100,000 - $140,000•Onsite

About The Position

EHE Health is seeking a talented Security and Privacy Manager to lead and evolve our enterprise cybersecurity and privacy program, reducing risk exposure and strengthening our control environment. This role will be responsible for advancing our compliance and certification efforts, while conducting internal audits, risk assessments and ongoing security analyses to ensure our processes and controls remain effective, scalable and aligned with industry best practices. The ideal candidate is intellectually curious, detail-oriented and proactive with a collaborative mindset and a bias toward continuous improvement rather than maintaining the status quo. This individual will bring both the capability and ambition to grow within the organization. To support this trajectory, the Security and Privacy Manager will partner closely with a fractional CISO who will provide hands-on mentorship, strategic guidance and development support, enabling the individual to build the experience and leadership capabilities required for long-term success.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field
3–5 years’ experience in information security, cybersecurity, or privacy program operations
Hands-on experience supporting or operating security and/or privacy programs within ISO27001, ISO27701, SOC2 Type 2 frameworks
Working knowledge of HIPAA and the HITECH Act, healthcare or regulated industry experience preferred
Practical experience participating in cybersecurity incident response, either as a respondent or incident manager
Familiarity with the NIST Cybersecurity Framework (CSF), including its core functions: Govern, Identify, Protect, Detect, Respond and Recover
Strong written and verbal communication skills, with the ability to clearly convey complex security concepts to both technical and non-technical stakeholders
Demonstrable experience implementing or auditing identity and access management for on-premise and cloud-based services
Ability to identify and assess emerging technology risks (e.g. software supply chain and AI)

Nice To Haves

Relevant industry certifications (e.g., CISSP, CCSP, CISM) preferred

Responsibilities

Conduct comprehensive security and privacy audits across networks, systems, applications, platforms, databases, and operational processes in alignment with established audit standards
Support and perform enterprise risk assessments to evaluate the design and effectiveness of controls across EHE’s technology and business environments
Manage the third-party risk management program, including due diligence, ongoing monitoring, and enforcement of EHE security and privacy requirements
Partner with IT and business stakeholders to communicate control requirements, strengthen adoption, and reinforce a robust control environment
Drive enterprise-wide awareness of cybersecurity and privacy policies through targeted education and engagement initiatives
Monitor and analyze security event data across computing platforms, networks, and security tools to identify risks, trends, and potential threats
Develop and deliver regular security metrics, dashboards, and operational reports to inform decision-making and leadership visibility
Conduct ongoing threat research, including emerging technologies such as artificial intelligence and evolving threat actors, to proactively assess business impact
Design and implement scalable, measurable, and repeatable security and privacy strategies aligned with organizational objectives
Lead and manage responses to prospective and existing client security and privacy inquiries, including questionnaires, due diligence requests, and audits