Information Security Program Manager

Job SummaryThe Information Security Program Manager is responsible for planning, managing, and executing various security-related internal and external audits and risk assessments. This role supports the organization's efforts to maintain high standards of information security and compliance with regulatory and industry standards. The Program Manager will work closely with the Information Security Officer and IT Leadership to support risk analyses and drive security improvement projects across the organization. Additionally, the role involves coordination and oversight of remediation efforts arising from audit findings, security incidents, and risk assessments to ensure effective and timely resolution.

Key Responsibilities Audit and Risk Assessment ManagementPlan and manage the schedule for internal and external information security audits, ensuring all activities are completed on time and within scope. Coordinate with external auditors and internal stakeholders to facilitate smooth and efficient audit processes. Lead the execution of risk assessments to identify vulnerabilities, assess their impact, and prioritize them for remediation.

• Security Improvement ProjectsSupport the Information Security Officer in conducting comprehensive risk analyses to identify areas for security enhancements.
• Develop and manage security improvement projects from initiation to closure, ensuring objectives are met and improvements are effectively implemented.
• Collaborate with IT and business units to integrate security best practices into operational processes and systems.

• Remediation and Incident ResponseCoordinate the pull-through of remediation actions stemming from audit findings, risk assessments, and security incidents, tracking progress until full resolution.
• Assist in developing and refining the organization’s incident response plan, ensuring readiness to swiftly address and mitigate security incidents.
• Facilitate post-incident reviews to identify lessons learned and integrate them into future security strategies and plans.

Compliance and ReportingEnsure compliance with relevant legal, regulatory, and industry standards pertaining to information security. Prepare and present regular reports on audit results, risk assessment findings, remediation progress, and overall security posture to senior management and relevant stakeholders.

Required Skills/Abilities:Bachelor's degree in Information Technology, Cybersecurity, Industrial engineering or a related field. A minimum of 3 years of experience in information security. Proven experience managing information security audits, risk assessments, and/or compliance initiatives. Strong understanding of information security principles, frameworks (e.g., ISO 27001, NIST), and regulations (e.g., PCI, HIPAA). Excellent project management skills, with the ability to manage multiple projects simultaneously and under tight deadlines. Strong analytical, problem-solving, and decision-making capabilities. Effective communication and interpersonal skills, with the ability to interact with a variety of stakeholders across the organization.