|Company||The Washington Companies|
|Preferred GIAC Certifications||GSLC, GSTRT, GCCC|
|Contact Name||Matt Rider|
Secure information and technology are critical to business success. The Manager of Enterprise IT Security (MITS) is responsible for establishing and maintaining the information security program to ensure that information assets and associated technology, applications, systems, infrastructure, and processes are adequately protected in the digital ecosystem in which we operate. They are responsible for identifying, evaluating, and reporting on cybersecurity risk to information assets, while supporting and advancing business objectives.
This position requires a proven leader with sound knowledge of business management and a strong working knowledge of cybersecurity technologies covering the corporate network as well as the broader digital ecosystem. They will proactively work with risk management teams, operating company, and ecosystem partners to implement practices that meet agreed-on policies and standards for information security. They should understand IT and must oversee a variety of cybersecurity and risk management activities related to IT to ensure the achievement of business outcomes where the business process is dependent on technology. They will be responsible for implementing and running the enterprise information security program.
The MITS should understand and articulate the impact of cybersecurity on (digital) business and be able to communicate this to senior stakeholders. They understand that securing information assets and associated technology, applications, systems, and processes in the wider ecosystem in which the organization operates is as important as protecting information within the organization's perimeter.
A key element of the role is working with executive management to determine acceptable levels of risk for the organization. The MITS must be knowledgeable about both internal and external business environments and ensure that information systems are maintained in a fully functional and secure mode and are compliant with legal, regulatory, and contractual obligations. The ideal candidate is a thought leader, a builder of consensus and of bridges between business and technology. He or she is an integrator of people, process, and technology. As the leader of the information security program, he or she must also be able to coordinate disparate drivers, constraints, and personalities, while maintaining objectivity and a strong understanding that cybersecurity is foundational for the organization to deliver on its business goals and objectives. Ultimately, the MITS is a business leader, and should have a track record of competency in the field of information security and/or risk management, with seven to 10 years of relevant experience, including five years in an IT leadership or consulting role.
Duties and Responsibilities:
Provide regular reporting on the status of the information security program to the enterprise risk management team, senior business leaders and the VP of Technology as part of a strategic enterprise risk management program, thus supporting business outcomes.
Create and manage a targeted information security awareness training program for all employees, contractors, and approved system users, and establish metrics to measure the effectiveness of this security training program for the different audiences.
Understand and interact with related disciplines to ensure the consistent application of policies and standards across all technology projects, systems, and services, including privacy, risk management, compliance, and business continuity management.
Provide clear risk mitigating directives for projects with components in IT, including the mandatory application of controls.
Champion the security program to mobilize employees in all locations.
Lead the Organization
Lead the information security function to ensure consistent and high-quality information security management in support of the business goals.
Determine the information security approach and operating model in consultation with the VP of Technology and aligned with the risk and compliance management functions with the businesses.
Manage the budget for the information security function, monitoring, and reporting discrepancies.
Manage a cost-efficient information security organization, consisting of direct reports and dotted line reports (such as individuals in business continuity and IT operations). This includes hiring, training, staff development, performance management and annual performance reviews.
Set the Strategy
Work with the VP of Technology to develop an information security vision and strategy that is aligned to organizational priorities and enables and facilitates the organization's business objectives, and ensure senior stakeholder buy-in and mandate.
Develop, implement, and monitor a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy, and recovery of information assets owned, controlled or/and processed by the organization.
Assist with the identification of non-IT managed IT services in use ("citizen IT") and facilitate a corporate IT onboarding program to bring these services into the scope of the IT function and apply standard controls and rigor to these services; where this is not possible, ensure that risk is reduced to the appropriate levels and ownership of this information security risk is clear.
Work effectively with operating companies to facilitate information security risk assessment and risk management processes and empower them to own and accept the level of risk they deem appropriate for their specific risk appetite.
Implement the Framework
Work with the VP of Technology to develop and enhance an up-to-date information security management framework based on CIS and NIST standards.
Create and manage a unified and flexible control framework to integrate and normalize the wide variety and ever-changing requirements resulting from global laws, standards, and regulations.
Develop and maintain a document framework of continuously up-to-date information security policies, standards, and guidelines. Oversee the approval and publication of these information security policies and practices.
Create a framework for roles and responsibilities regarding information ownership, classification, accountability, and protection n of information assets.
Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the information security, and review it with stakeholders at the executive and board levels.
Communicate the Vision
Create the necessary internal networks among the information security team and line-of-business executives, corporate compliance, audit, physical security, legal and HR management teams to ensure alignment as required.
Build and nurture external networks consisting of industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, incidents, and cybersecurity risks.
Liaise with the enterprise architecture team to build alignment between the security and enterprise (reference) architectures, thus ensuring that information security requirements are implicit in these architectures and security is built in by design.
Operate the Function
Create a risk-based process for the assessment and mitigation of any information security risk in your ecosystem consisting of supply chain partners, vendors, consumers and any other third parties.
Work with the compliance staff to ensure that all information owned, collected, or controlled by or on behalf of the company is processed and stored in accordance with applicable laws and other global regulatory requirements, such as data privacy.
Collaborate and liaise with risk management teams to ensure that data privacy and data retention requirements are included where applicable.
Define and facilitate the processes for information security risk and for legal and regulatory assessments, including the reporting and oversight of treatment efforts to address negative findings.
Ensure that security is embedded in the project delivery process by providing the appropriate information security policies, practices, and guidelines.
Oversee technology dependencies outside of direct organizational control. This includes reviewing contracts and the creation of alternatives for managing risk.
Manage and contain information security incidents and events to protect corporate IT assets, intellectual property, regulated data, and the company's reputation.
Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action.
Coordinate the development of implementation of incident response plans and procedures to ensure that business-critical services are recovered in the event of a security event; provide direction, support, and in-house consulting in these areas.
Facilitate and support the development of asset inventories, including information assets in cloud services and in other parties in the organization's ecosystem.
Facilitate both the internal and externa audit and validations programs for IT security, working with risk management leadership where needed.
Knowledge, Skills, and Abilities:
Minimum of seven to 10 years of experience in a combination of risk management, information security and IT or OT jobs, with at least five in an IT leadership or consulting role.
High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity
Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical audiences at various hierarchical levels, ranging from board members to technical specialists
Strategic leader and builder of both vision and bridges, and able to energize the appropriate teams in the organization
Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies
Up-to-date knowledge of methodologies and trends in both business and IT
Proven track record and experience in developing information security policies and procedures, as well as successfully executing programs that meet the objectives of excellence in a dynamic business environment
Poise and ability to act calmly and competently in high-pressure, high-stress situations
Must be a critical thinker, with strong problem-solving skills
Excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives
Project management skills: financial/budget management, scheduling, and resource management
Ability to lead and motivate the information security team to achieve tactical and strategic goals, even when only "dotted line" reporting lines exist
Ability to influence entities and decisions in situations where no formal reporting structures exist, but achieving the desirable outcome is vital
Degree in business administration or a technology-related field, or equivalent work- or education-related experience
Professional security management certification is desirable, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials.
Knowledge of common information security management frameworks such as CIS Controls, ITIL, NIST or other leading frameworks.
Experience with contract and vendor negotiations
Excellent stakeholder management skills
High degree of initiative, dependability, and ability to work with little supervision while being resilient to change
Additional background investigations and reference checks may be conducted as part of hiring process