Information Security Manager

Key Responsibilities

Security Program Management and Governance

• Manage the security program's annual work plan and implementation of approved priorities.
• Author, maintain, and coordinate approval of information security policies, standards, and procedures.
• Coordinate policy implementation, employee communications, periodic reviews, and exception documentation.
• Coordinate external security service providers and monitor delivery against agreed service expectations.
• Develop security budget recommendations, evaluate proposed tools and services, and track approved expenditures.
• Maintain security metrics and report program performance, control gaps, and resource needs to leadership.

Risk Management and Compliance

• Conduct and coordinate security risk assessments; maintain the risk register and track remediation plans.
• Apply the NIST Cybersecurity Framework to assess security capabilities, identify gaps, and recommend prioritized improvements.
• Document risk treatment recommendations and route exceptions and risk acceptance decisions to authorized leadership.
• Support applicable HIPAA Security Rule compliance activities, including risk analysis, safeguard implementation, policy documentation, and corrective actions.
• Coordinate security audits, evidence collection, control assessments, and responses to findings.
• Conduct vendor security assessments, review contractual security requirements, and respond to external security questionnaires.
• Support security obligations associated with research agreements, grants, contracts, and data-use arrangements.

Security Operations and Technical Risk Management

• Coordinate daily security monitoring, alert escalation, vulnerability management, and remediation tracking.
• Coordinate with external monitoring providers; maintain investigation and escalation procedures.
• Coordinate vulnerability assessments and penetration testing, prioritize findings with IT and system owners, and track corrective actions to completion.
• Monitor the coverage and effectiveness of endpoint, identity, email, network, cloud, and logging controls.
• Coordinate security-tool deployment, configuration, integration, tuning, and maintenance with technical teams.
• Partner with IT and system owners on secure configurations, privileged access, access reviews, and account lifecycle controls.

Incident Response and Recovery

• Maintain and exercise the incident response plan and supporting operational playbooks.
• Coordinate security investigations, containment, recovery, and post-incident corrective actions, escalating significant incidents to leadership.
• Maintain incident documentation and communicate findings to designated stakeholders.
• Partner with IT and operational owners on backup security, recovery planning, and exercises.
• Participate in after-hours incident response under established coverage arrangements.

Research Data Protection and Security Awareness

• Partner with researchers, clinical teams, and IT to secure sensitive data access, storage, transfer, and collaboration.
• Review proposed systems and workflows and recommend practical security safeguards.
• Develop and deliver security awareness training, phishing education, and guidance for specialized teams.
• Communicate security requirements clearly and help stakeholders implement them.

Required Qualifications

• Bachelor's degree in information security, computer science, or a related field, or equivalent relevant experience.
• At least 5 years of progressively responsible information security experience, including at least 2 years managing security projects, operational functions, or program components.
• Demonstrated experience applying the NIST Cybersecurity Framework to assess controls, identify gaps, prioritize improvements, and track remediation.
• Demonstrated experience with security risk assessments, incident response, vulnerability management, and third-party security risk.
• Experience authoring and revising security policies, standards, and procedures and coordinating their review and implementation.
• Experience implementing, monitoring or coordinating security controls across identity systems, endpoints, networks, cloud services, and monitoring platforms.
• Experience coordinating technical teams and vendors and presenting actionable security recommendations to management.

Preferred Qualifications

• CISSP, CISM, or a comparable security certification.
• Experience in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.
• Experience supporting federally funded research or implementing contractual, sponsor, or data-use security requirements.
• Experience applying NIST SP 800-53 or SP 800-171 to applicable security obligations.
• Experience managing external security providers.

Work Location

This position will require to be on site at least 2 days a week at our downtown Manhattan location. Occasional evening and weekend work may be required.