Accountabilities

Security program leadership: Develop, implement, and maintain information security programs aligned with business objectives, regulatory obligations, industry standards, and client requirements.

Executive advisory and reporting: Advise senior leadership on security strategy, policies, standards, emerging threats, and potential incidents while communicating program progress, risks, and remediation priorities.

Security policies and controls: Establish and maintain security policies and procedures that safeguard the confidentiality, integrity, and availability of information systems and data.

Security solutions and operations: Oversee the implementation and effectiveness of security solutions, monitor changes in client environments, and coordinate incident detection, response, and resolution within established service-level agreements.

Risk assessments and vulnerability management: Lead internal, technical, and third-party risk assessments, coordinate vulnerability scanning and penetration testing, and recommend appropriate mitigation strategies.

Regulatory compliance: Guide clients in implementing and maintaining controls aligned with frameworks and regulations such as NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable requirements.

Audit and certification support: Coordinate security audits, assessments, and certification activities by preparing evidence, clarifying control requirements, addressing findings, and tracking remediation progress.

Risk and control management: Evaluate control maturity, identify compliance gaps, prioritize corrective actions, maintain cross-framework control mappings, and document compensating controls and risk acceptance decisions.

Protection of regulated environments: Define security requirements for systems containing sensitive or regulated information, including electronic protected health information (ePHI), payment card data, and controlled unclassified information (CUI). Apply data classification, network segmentation, and other safeguards to manage exposure.

Business continuity and disaster recovery: Develop, maintain, and coordinate testing of disaster recovery and business continuity plans tailored to client systems, facilities, and operational needs.

Security awareness and collaboration: Develop and monitor security awareness training programs, collaborate with cross-functional teams to deliver secure solutions, and participate in client steering committees and working groups.

Client relationship management: Serve as a trusted security advisor, translating complex technical and regulatory requirements into practical recommendations that support business objectives and reduce organizational risk.

Requirements

Education: A bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related discipline, or equivalent professional experience.

Information security leadership: At least five years of information security leadership experience, such as Chief Information Security Officer (CISO), virtual CISO (vCISO), or another senior security leadership position.

Technical security experience: At least three years of experience in security operations, security engineering, vulnerability management, system administration, or a related technical discipline.

Consulting and client management: Experience in consulting or managed security services, preferably supporting multiple clients across regulated industries such as healthcare, financial services, or government contracting.

Compliance and control implementation: At least three years of hands-on experience implementing and operating security controls aligned with frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS.

Audit and assessment experience: Demonstrated experience acting as a security point of contact during external audits, regulatory assessments, and certification processes.

Risk management expertise: Working knowledge of risk assessment and management methodologies, including NIST Risk Management Framework (RMF), NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR, with the ability to apply them to risk treatment, prioritization, and reporting.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1