Sr. Manager Information Security

The Sr. Manager, Information Security is responsible for overseeing a team of IT Security professionals and creating strategies to improve and monitor the security of Cirrus systems. The Sr. Manager, Information Security is responsible for developing, implementing, and maintaining an information security capability that protects the organization’s information assets. This role involves overseeing security policies, risk management, compliance, incident response, and employee training. This leader will possess a deep understanding of information security frameworks and have a proven track record in managing security teams and projects.

This role reports to the Executive Director, Digital Transformation & Technology.

Duties and Responsibilities/Essential Functions

To perform this job successfully, an individual must be able to perform each essential function satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions.

• High Performing Team: Build high performing team of IT Security professionals that plan and design security solutions that enable the organization to identify, protect, detect, respond, and recover from cyber threats and vulnerabilities. Selects, develops and evaluates personnel to ensure the efficient operation of the function. Provides leadership and mentorship to the information security team, fostering a culture of security awareness.
• Vision/Strategy/Roadmap: Creates Information Security and Cybersecurity strategy, roadmap, goals, objectives and metrics to mitigate business threats, address opportunities and prioritize for protection of critical systems. Prioritize projects, financials, and KPIs to measure progress against the roadmap while leveraging both mainstream and emerging technologies to transform the information security capability. Prepare and present reports on security metrics, incidents, and compliance status to executive management.
• Security Architectures: Oversees the planning, design and build of security architectures. Ensures the implementation of network and computer security is compliant with corporate cybersecurity policies and procedures. Responsible for mitigating enterprise cybersecurity risks for local area networks (LANs), wide area networks (WANs), virtual private networks (VPNs), routers, firewalls, and related network devices. Configures and installs firewalls and intrusion detection systems. Implements software fixes (patches) to remove system vulnerabilities. Owns incident response planning, leads vulnerability audits and forensic investigations. Evaluates potential business impacts from security breaches and provides strategic and tactical guidance to Executive & business decision-makers. Responsible for security systems compliance policies and procedures.
• Vulnerability Assessments: Performs security assessments, penetration tests, vulnerability scans and risk analysis across the Cirrus ecosystem. Manage vulnerability assessments and security audits to identify cybersecurity risks. Drives improvements necessary to mitigate those risks. Performs technical analysis of vulnerabilities and leads in the development of vulnerability corrective action plans. Conducts a regular review of network, application and operation system security documents and procedures. Reviews results of vulnerability assessments and code reviews and informs management of vulnerabilities, risk and mitigation. Provides technical expertise to the vulnerability assessment team responsible for the testing, validating, and the security of the company’s applications, servers, and networks.
• Cybersecurity Focus: Identifies cybersecurity architecture, goals, objectives and metrics; analyzes business needs and priorities for protection of critical systems. Keeps abreast of the latest intelligence from law enforcement and other sources of cyber threat information. Monitors systems for cybersecurity vulnerabilities, threats and events, oversees incident response planning, and leads vulnerability audits and forensic investigations. Evaluates potential business impacts from security breaches and provides strategic and tactical guidance to business decision-makers. Reviews, manages and approves the action plans for policy creation and governance, system hardening, monitoring, incident response, disaster recovery, and emerging cybersecurity threats.
• Security Controls: Manages the development, deployment and execution of controls and defenses to ensure the security and risk mitigation of company infrastructure technology, information systems and digital payment systems. This includes leading investigations with any suppliers th