Security Manger

Summary:

The Manager, Cyber Security is responsible for establishing and maintaining the enterprise vision, strategy, architecture, and assisting in developing the multi-year roadmap that ensures that the company’s information assets are adequately protected. 

 A key element of this role is communicating cyber security concepts at a strategic level to senior management, Board members, and evangelizing cyber security across the business to drive adoption of best practices.  

The Manager, Cyber Security Engineering will manage a small team of dedicated cyber security team members in India. 

• Collaborate with the Dir, CSEA to develop and implement a strategic, long-term information security strategy and roadmap to ensure that GHX’s information assets are adequately protected. 

• Work with senior leaders across the business to assess and communicate acceptable levels of risk. 

• Identify, evaluate and report on information security risks, practices and projects to the senior security management, and provide subject matter expertise on cyber security engineering in line with standards and best practices (e.g. FedRAMP, PCI, ISO etc.). 

• Provide input into the development of up-to-date cyber security policies, procedures, standards and guidelines, and assist in  their approval, dissemination, and maintenance. 

• Ensure that the cyber security management program is following applicable laws, regulations, and contractual requirements. 

• Act as the champion for the enterprise cyber security program and foster a security-aware culture. 

• Oversee the evaluation, selection and implementation of information security solutions that are innovative, cost-effective, and minimally disruptive. 

• Partner with enterprise architects, infrastructure, and applications teams to ensure that security controls are developed and maintained according to security policies and guidelines. 

• Assist in developing business metrics to measure the effectiveness of the security management program, and increase the maturity of the program over time. 

• Monitor the industry and external environment for emerging threats and advise relevant stakeholders on appropriate courses of action. 

• Assist in incident response planning and the investigation of security breaches, and assist with any associated disciplinary, public relations and legal matters. 

  What You Will Need  

• Bachelor’s degree in computer science or related field plus 8 years related experience, OR Master’s degree plus 3 years related experience. 

• Confirmed experience related to hands on technical focus across many areas of security engineering (Ex: Network Segmentation, firewalls, secure remote access, cloud security, IAM, PAM, EDR, DLP etc.) 

• A proven track record in developing information security policies and procedures, and successful execution. 

• Extensive knowledge of business risk, risk assessment and risk-based decision making. 

• Able to communicate security and risk-related concepts to both technical and non-technical audiences (in business terms), including executive level. 

• Ability to inspire and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals; an innovative leader, problem solver and consultant. 

• Ability to evangelize IT security to make it a critical part of business operations; build trust and respect for the security function. 

• Management experience with demonstrated deliveries in developing a team. 

• Excellent written and verbal communication, interpersonal and collaborative skills. 

• Experienced with contract and vendor negotiations. 

• Ability to effectively prioritize and execute tasks in high-pressure situations. 

• Knowledge of security, risk and control frameworks and standards such as ISO 27001 and 27002, NIST 800-53, HITRUST and FedRAMP. 

• Understanding of cloud, SaaS, and IoT architectures, and their implications on information security strategy. 

• Technical acumen including but not limited to: Security Engineering, IT infrastructure, cloud, application development languages, tools and frameworks, database technologies, web technologies, next gen mobile, network architecture, enterprise architecture, and directory services. 

• Security technology acumen and experience including but not limited to: 

• firewall, intrusion detection, cyber-attack tools and defenses, encryption, 

• certificate authority, web filtering, anti-malware, anti-phishing, identity and 

• access management, multi factor authentication.