cybersecurity risk manager

Turbo Consultin

Role purpose: Leads practical, mission-aligned cybersecurity governance across customer's systems by driving assessment documentation, control implementation guidance, risk evaluations, contingency planning, POA&amp;M management, and cyber compliance reporting.Core responsibilitiesProvide actionable cybersecurity guidance to system and product teams on control implementation, risk mitigation, and compliance with federal and HHS requirements.Develop, upload, maintain, and quality-check assessment artifacts including FIPS 199 categorizations, E-Authentication risk assessments, control implementation statements, and supporting evidence.Evaluate cybersecurity risk for new capabilities, integrations, applications, plug-ins, and system connections before deployment.Lead development, testing, and update cycles for system contingency plans, security SOPs, and governance playbooks.Maintain POA&amp;M tracking, remediation coordination, vulnerability status reporting, and risk dashboards for leadership review.Coordinate closely with engineering, operations, and incident response teams on vulnerability management, incident handling, and cyber data calls.Support audit readiness and maintain evidence packages that withstand IV&amp;V, assessor, and government review.Minimum qualificationsBachelor&rsquo;s degree in cybersecurity, information assurance, computer science, or related field; master&rsquo;s degree preferred.10+ years of cybersecurity risk, compliance, or RMF experience, including at least 5 years supporting federal systems.Deep working knowledge of NIST RMF, FISMA, HHS/NIH controls, SSPs, POA&amp;Ms, contingency planning, and security documentation.Proven ability to coordinate across technical and non-technical stakeholders in a fast-paced mission environment.CISSP and CAP strongly preferred; CISM, FedRAMP Practitioner, or Zero Trust training desirable.Experience with cloud security, SaaS governance, vulnerability scanning, and continuous monitoring.Familiarity with risk repositories, evidence management, dashboards, and governance reporting.Preferred qualifications / certificationsExperience supporting healthcare, research, or biomedical environments handling sensitive data.Pay: $150,000.00 - $200,000.00 per yearBenefits:<ul><li>401(k)</li><li>401(k) matching</li><li>Dental insurance</li><li>Health insurance</li><li>Life insurance</li><li>Paid time off</li><li>Retirement plan</li><li>Vision insurance</li></ul>Work Location: Hybrid remote in Washington, DC 20036

Cybersecurity Risk Manager

Baylor Scott & White Health

<div>JOB SUMMARY
Hybrid position
The Cybersecurity Risk Manager plays a key role in strengthening the cyber risk management capabilities across a large, complex healthcare environment. This position leads a team responsible for identifying, assessing, and managing risks that impact clinical systems, patient data, operational continuity, and enterprise information assets.
You will collaborate with technology, clinical, compliance, and operational teams to ensure risk‑management practices are:<ul><li> Well‑structured, repeatable, and aligned with industry frameworks such as NIST CSF 2.0.</li><li> Compliant with regulatory requirements, including the HIPAA Security Rule.</li></ul>
ESSENTIAL FUNCTIONS OF THE ROLE
Risk Management Leadership<ul><li>
Lead a team of cybersecurity analysts executing risk identification, analysis, scoring, and monitoring.</li><li>
Guide the development and continual enhancement of risk‑management processes using industry frameworks (e.g., NIST CSF 2.0, HIPAA).</li><li>
Provide coaching, performance feedback, and professional development support to team members.</li><li>
Promote alignment and consistency across cybersecurity and IT functions regarding risk practices and governance.</li></ul>
Reporting &amp; Continuous Improvement<ul><li>
Develop clear, concise risk reporting through associated tooling, tailored for senior leaders and operational stakeholders.</li><li>
Track and measure progress through Objectives &amp; Key Results (OKRs) aligned to cybersecurity and organizational priorities.</li><li>
Identify opportunities to streamline processes, drive operational excellence, and improve transparency into cyber risk.</li></ul>
Risk Management &amp; Assessment<ul><li>
Oversee enterprise-wide cyber risk assessments, including but not limited to EHR systems, medical devices, IoT clinical equipment, and cloud-hosted PHI.</li><li>
Lead threat modeling and control evaluations based on NIST CSF 2.0 categories (Identify, Protect, Detect, Respond, Recover, Govern).</li><li>
Coordinate mitigation strategies with IT, Clinical Engineering, and operational leaders.</li><li><ul><li> Support risk-related governance forums and risk review discussions with leadership.</li></ul></li><li>
Maintain risk registers and compliance monitoring.</li></ul>
Compliance &amp; Regulatory Alignment<ul><li>
Continuously refine cyber risk processes informed by healthcare threat intelligence, regulatory changes, and HIPAA Security Rule requirements.</li><li>
Oversee periodic audits and corrective action tracking.</li><li>
Ability to execute tasks through tooling such as ServiceNow, M365, and Power BI.</li></ul>
KEY SUCCESS FACTORS<ul><li>
Master&rsquo;s Degree is preferred in Cybersecurity, Information Systems, Risk Management, or related field.</li><li>
Strong understanding of healthcare technology environments (e.g., EHR systems, clinical devices, PHI handling).</li><li>
Demonstrated ability to communicate risk effectively to both technical and non-technical audiences.</li><li>
Experience working within Agile delivery environments.</li><li>
Experience with NIST CSF 2.0, HITRUST, HIPAA Security Rule, and healthcare technology environments.</li><li>
Strong understanding of clinical workflows, EHR systems, and medical device cybersecurity.</li><li>
Proficiency with GRC and risk platforms.</li><li>
Certifications such as CISSP, CISM, CRISC, HCISPP, HITRUST CCSFP, or other relevant industry certifications are strongly preferred.<div> 
BENEFITS 
 
Our competitive benefits package includes the following 
<ul><li>Immediate eligibility for health and welfare benefits</li><li>401(k) savings plan with dollar-for-dollar match up to 5%</li><li>Tuition Reimbursement</li><li>PTO accrual beginning Day 1</li></ul>
Note: Benefits may vary based upon position type and/or level</div></li></ul> 
QUALIFICATIONS 
 
- EDUCATION - Bachelor's or 4 years of work experience above the minimum qualification 
 
- EXPERIENCE - 5 Years of Experience</div>

Cybersecurity Risk Manager - Healthcare

Qiddiya Investment Company

<div>Qiddiya Investment Company is on the hunt for a highly skilled and visionary Senior Manager - Cybersecurity Risk Management to lead our cybersecurity initiatives in a rapidly evolving digital landscape. This critical role will involve overseeing the development and implementation of a robust cybersecurity risk management strategy that safeguards our assets while ensuring compliance with industry standards and regulations.
You will be tasked with identifying and mitigating cybersecurity risks, fostering a culture of security awareness, and leading a team dedicated to maintaining the integrity and security of our information systems. Your expertise will be essential in shaping the direction of our cybersecurity posture in alignment with our business objectives.
Key Responsibilities<ul>
<li>Develop and implement a comprehensive cybersecurity risk management framework tailored to organizational needs and regulatory requirements.</li>
<li>Lead risk assessments and vulnerability assessments to identify threats and exposures associated with information systems.</li>
<li>Oversee the creation and maintenance of a cybersecurity risk register, tracking and reporting on identified risks and mitigation efforts.</li>
<li>Collaborate with IT, legal, and compliance teams to ensure that cybersecurity measures align with overall enterprise risk management strategies.</li>
<li>Drive the development and execution of training and awareness programs to ensure all employees understand their role in cybersecurity risk management.</li>
<li>Prepare and present detailed reports on cybersecurity risks and compliance to executive leadership and stakeholders.</li>
<li>Stay abreast of emerging cybersecurity threats and trends, providing strategic guidance to adapt risk management practices accordingly.</li>
<li>Mentor and lead the cybersecurity risk management team, ensuring their professional growth and expertise in the field.</li> 
</ul> 
 
Requirements 
<ul>
<li>Bachelor's degree in Cybersecurity, Information Technology, Risk Management, or a related field; a master&rsquo;s degree is preferred.</li>
<li>7+ years of experience in cybersecurity risk management or related roles, with substantial experience in leadership positions.</li>
<li>Strong knowledge of cybersecurity frameworks, methodologies, and industry best practices (e.g., NIST, ISO 27001, COBIT).</li>
<li>Expertise in risk assessment methodologies and risk mitigation strategies.</li>
<li>Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Risk Management Professional (CRMP), or equivalent are highly desirable.</li>
<li>Exceptional analytical, organizational, and communication skills.</li>
<li>A proactive and strategic mindset, capable of navigating complex challenges in cybersecurity.</li> 
</ul> 
 
Benefits 
Offering a comprehensive compensation and benefits package.</div>

Senior Manager - Cybersecurity Risk Management

Grant Thornton

<div>The professionals in GT Advisors' Cybersecurity practice help organizations build cybersecurity strategy into their overall business strategy. This includes supporting our clients to identify and understand their cyber risk exposure, design and implement cybersecurity programs and solutions to mitigate cyber threats and protect their assets, and respond to cyber-attacks and incidents. GT Advisors&rsquo; Cybersecurity practice is in high-demand and rapidly growing, offering a rewarding and challenging working environment and great career growth potential.
As a member of the Cybersecurity team, you will have the opportunity to collaborate with our clients and deliver technical cybersecurity consulting and advisory services across a broad spectrum of areas, including threat and vulnerability management, technical security testing, cybersecurity assessments, incident response readiness, and cybersecurity strategy activities.
The Senior Manager role offers an excellent opportunity to leverage and display both your technical knowledge and experience as well as your business and project management skills. Responsibilities include managing and performing cybersecurity assessments and technical security testing, design and implementation of operational security solutions, end-to-end client engagement lifecycle management, and supervising other colleagues. The Senior Manager is also responsible for supporting the growth of the practice through business development activities.
Your day-to-day may include:
<ul><li>Manage, lead, and perform cybersecurity assessments consisting of cybersecurity capability assessments, cyber threat and risk assessments, network and security architecture reviews, compliance and regulatory assessments, and system configuration reviews.
</li><li>Manage, lead, and perform technical security testing, including cyber-attack simulations and threat and vulnerability assessments.
</li><li>Manage and support cybersecurity incident response readiness activities, including tabletop exercises and evaluations of incident response capabilities.
</li><li>Lead practice and business development activities as well as client pursuit opportunities.
</li><li>Support evaluating and establishing organizational cybersecurity strategies and cybersecurity programs.
</li><li>Support cybersecurity risk and control remediation and security control implementation activities.
</li><li>Develop strategic recommendations and consultative guidance for clients to help mature their cybersecurity programs, technology, processes and capabilities.
</li><li>Manage assigned client engagements from start to finish, which includes engagement planning, fieldwork execution and reporting.
</li><li>Manage and oversee client engagement delivery teams and perform quality review.
</li><li>Remain current and apply knowledge of cybersecurity trends and risks.
</li><li>Communicate and collaborate externally with clients and internally with all levels of the organization to successfully accomplish objectives portraying knowledge and confidence.
</li><li>Proactively interact with key client management to gather information, resolve problems, and make recommendations for improvements.
</li><li>Develop and manage client relationships with the intention to exceed client expectations.
</li><li>Adhere to the highest degree of professional standards and strict client confidentiality.
</li><li>Participate in professional development activities and training sessions on regular basis.
</li><li>Other duties as assigned.
</li></ul>You have the following technical skills and qualifications:
<ul><li>Bachelor's degree in Information Technology, Cybersecurity, Computer Science or a related field is required
</li><li>CISSP, CISM, ISACA, CRISC, cloud security (e.g., AZ-500, AWS Certified Security, Google Cloud Professional Architect / Security Engineer) or other related certifications required
</li><li>10+ years of related cybersecurity experience in a similar consulting practice or function.
</li><li>Experience leading and managing one or more of the overarching areas below:
<ul><li>Assessing cybersecurity programs and capabilities against industry leading frameworks (e.g., NIST CSF, CRI Profile) and compliance and regulatory requirements.
</li><li>Reviewing security architecture deployments and assessing and/or implementing secure configurations for network and infrastructure (including both on-premises and cloud environments).
</li><li>Performing cybersecurity threat and risk assessments.
</li><li>Supporting cybersecurity program remediation activities.
</li><li>Supporting cybersecurity compliance and regulatory remediation workstreams.
</li><li>Supporting implementation and evaluation of zero trust architecture principles.
</li><li>Supporting artificial intelligence (AI) security testing and assessments.
</li><li>Assessing and/or implementing security solutions and controls across both on-premises and cloud network environments.
</li></ul></li><li>Working knowledge of cybersecurity industry leading practices and frameworks, such as NIST CSF, CRI Profile, ISO 27001/2, NYS DFS 500, OWASP, MITRE ATT&amp;CK.
</li><li>Familiarity with common cyber event detection and threat and vulnerability management security solutions.
</li><li>Strong project management skills and the ability to manage multiple engagements and competing priorities in a rapidly growing, fast-paced, interactive, results-based team environment.
</li><li>Experience with practice development and client pursuit activities.
</li><li>Exceptional client service and communication skills, with a demonstrated ability to develop and maintain outstanding client relationships.
</li><li>Excellent analytical, organizational and project management skills.
</li>Can travel as needed 
<li>
</li></ul>The base salary range for this position in New York, NY only is between $202,500 and $337,500.
The base salary range for this position in Chicago, IL only is between $187,500 - $312,000.</div>

Cyber Strategy & Management Senior Manager

Walmart

<div><h2 class="jobSectionHeader">Position Summary...</h2><h2 class="jobSectionHeader">
What you'll do...</h2>
Role summary:
 
The (USA) Staff, Risk Expert plays a critical role in identifying, assessing, and managing cyber risks to protect organizational assets. This position leads the development and implementation of advanced risk assessment techniques, evaluates emerging threats, and guides mitigation strategies aligned with corporate policies. The role requires collaboration with internal and external partners to enhance security posture, communicate risk insights, and support continuous improvement. The ideal candidate demonstrates expertise in cyber risk management, threat intelligence, and vulnerability assessment, contributing to the organization&rsquo;s resilience against evolving cybersecurity challenges.
 
About the team:
 
The Technical Controls Assessment team at Walmart focuses on safeguarding enterprise solutions by evaluating security controls and ensuring compliance with organizational policies. Leveraging expertise in risk analysis and cyber risk management, the team conducts vulnerability assessments and supports secure cloud transformations. Collaborating closely with stakeholders, they identify and mitigate digital threats to maintain a resilient security environment. This team&rsquo;s efforts enhance Walmart&rsquo;s security posture, reinforcing the company&rsquo;s dedication to innovation and trust across all operations and brands.
 
What you'll do:
 
<ul><li>Lead cyber risk assessment activities to identify and evaluate security threats, vulnerabilities, and potential business impacts.</li><li>
Develop and enhance risk management techniques aligned with organizational policies and emerging cyber threats.</li><li>
Analyze cybersecurity gaps and recommend appropriate risk treatment options to mitigate exposure.</li><li>
Collaborate with stakeholders to communicate risk findings and influence security strategy decisions.</li><li>
Conduct threat intelligence analysis to identify cyberattack methods and actors, providing actionable insights.</li><li>
Design and implement vulnerability assessment and security testing plans to strengthen network defenses.</li><li>
Drive continuous improvement of security policies, controls, and compliance monitoring processes.</li></ul>
 
What you'll bring:
 
<ul><li>Proven expertise in cyber risk assessment and management techniques, including identification and treatment of security risks, threats, and vulnerabilities.</li><li>
Strong knowledge of evolving cybersecurity threats and the ability to evaluate business risks from security gaps.</li><li>
Experience leading cyber risk assessment activities aligned with organizational policies and principles.</li><li>
Ability to analyze cybersecurity gaps and recommend effective risk mitigation strategies.</li><li>
Proficiency in stakeholder management, including communication and engagement to support risk initiatives.</li><li>
Skilled in threat intelligence analysis and network security principles.</li><li>
Familiarity with security assessment, testing methodologies, and vulnerability management.</li></ul>
At Walmart, we offer competitive pay as well as performance-based bonus awards and other great benefits for a happier mind, body, and wallet. Health benefits include medical, vision and dental coverage. Financial benefits include 401(k), stock purchase and company-paid life insurance. Paid time off benefits include PTO (including sick leave), parental leave, family care leave, bereavement, jury duty, and voting. Other benefits include short-term and long-term disability, company discounts, Military Leave Pay, adoption and surrogacy expense reimbursement, and more. You will also receive PTO and/or PPTO that can be used for vacation, sick leave, holidays, or other purposes. The amount you receive depends on your job classification and length of employment. It will meet or exceed the requirements of paid sick leave laws, where applicable. For information about PTO, see https://one.walmart.com/notices. Live Better U is a Walmart-paid education benefit program for full-time and part-time associates in Walmart and Sam's Club facilities. Programs range from high school completion to bachelor's degrees, including English Language Learning and short-form certificates. Tuition, books, and fees are completely paid for by Walmart.
 
Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to a specific plan or program terms.
 
For information about benefits and eligibility, see One.Walmart.
 
The annual salary range for this position is $110,000.00 - $220,000.00 Additional compensation includes annual or quarterly performance bonuses. Additional compensation for certain positions may also include :
 
<ul><li>Stock</li></ul>
ㅤ
ㅤ
ㅤ
ㅤ
&lrm;<h2 class="jobSectionHeader">
Minimum Qualifications...</h2>
Outlined below are the required minimum qualifications for this position. If none are listed, there are no minimum qualifications.
Option 1: Bachelor's degree in computer science, information technology, engineering, information systems, cybersecurity, or related area and 4years&rsquo; experience in cybersecurity risk or related area at a technology, retail, or data-driven company. 
 
Option 2: 6 years&rsquo; experience in cybersecurity risk or related area at a technology, retail, or data-driven company.<h2 class="jobSectionHeader">
Preferred Qualifications...</h2>
Outlined below are the optional preferred qualifications for this position. If none are listed, there are no preferred qualifications.
Certification in Security+, GISF, GSEC, CISA, CISSP, CCSP, or CISM, Master&rsquo;s degree in Computer Science, Information Technology, Engineering, Information Systems, Cybersecurity, or related area and 2 years&rsquo; experience leading information security or cybersecurity projects, We value candidates with a background in creating inclusive digital experiences, demonstrating knowledge in implementing Web Content Accessibility Guidelines (WCAG) 2.2 AA standards, assistive technologies, and integrating digital accessibility seamlessly. The ideal candidate would have knowledge of accessibility best practices and join us as we continue to create accessible products and services following Walmart&rsquo;s accessibility standards and guidelines for supporting an inclusive culture.
CISA - Certified Information Systems Auditor - Certification, CISSP - Certified Information Systems Security Professional - Certification<h2 class="jobSectionHeader">
Primary Location...</h2>
805 Se Moberly Ln, Bentonville, AR 72712, United States of America
Walmart and its subsidiaries are committed to maintaining a drug-free workplace and has a no tolerance policy regarding the use of illegal drugs and alcohol on the job. This policy applies to all employees and aims to create a safe and productive work environment.</div>

(USA) Staff, Risk Expert

Chalhoub Group

<div>INSPIRE | EXHILARATE | DELIGHT
For over seven decades, Chalhoub Group has been a partner and creator of luxury experiences in the Middle East. In its pursuit to excel as a hybrid luxury retailer, the Group has curated a portfolio of over 10 owned brands and strengthened its distribution and marketing expertise for over 400 international names across luxury fashion, beauty, jewellery, watches, eyewear, and art de vivre categories.
Every step at Chalhoub Group is taken to build a future where luxury dreams become reality &mdash; bridging cultures and crafting memorable experiences for our consumers. Be it by constantly reinventing itself, committing to innovation, or embracing new technologies, the Group is shaping the future of luxury retail. It delivers seamless omnichannel experiences across more than 950 stores, online platforms, and mobile apps. Driving this innovation journey is The Greenhouse &mdash; the Group&rsquo;s innovation hub, incubator, and accelerator for startups and emerging businesses, regionally and globally.
Chalhoub Group fosters a people-at-heart culture rooted in diversity, equity, and inclusion, and a workplace catalysed by forward thinking and future-proofing. Today, it brings together over 16,000 talented professionals across eight countries in the Middle East, with a presence in LATAM. Their collective efforts have earned the Group the Great Place to Work certification in several markets.
Sustainability is at the core of the Group&rsquo;s strategy, guided by a clear commitment to people, partners, and the planet. Chalhoub Group is proud to be a member of the United Nations Global Compact, a signatory of the Women&rsquo;s Empowerment Principles, and to have pledged to reach Net Zero by 2040. 
What You'll Be Doing
The Director of Information Security - GRC is a senior leadership role responsible for governing and institutionalizing cybersecurity risk, regulatory compliance, and control frameworks across Chalhoub Group&rsquo;s global operations. This role leads the design, implementation, and continuous enhancement of enterprise-wide GRC programs, enabling risk-informed decision-making, regulatory confidence, and security accountability across all business units.
As a key member of the Group&rsquo;s cybersecurity leadership team, this position partners with Legal, Internal Audit, Data Privacy, Procurement, HR, Retail Operations, and Technology to operationalize trust, embed policies, and ensure adherence to global and regional standards.
Key Responsibilities
GRC Strategy &amp; Operating Model - Design and execute the Group&rsquo;s Information Security GRC strategy, aligned with corporate risk management, technology transformation, and global expansion. Define the operating model, team structure, and KPIs to ensure scalable, repeatable, and effective governance practices.
Governance &amp; Policy Management - Develop, maintain, and socialize Group-wide security policies, standards, and procedures in alignment with ISO 27001, NIST CSF, COBIT, and business objectives. Lead cross-functional governance forums and ensure policy integration with HR, Legal, and IT service management.
Risk Management &amp; Control Frameworks - Own the Information Security Risk Management Framework (ISRMF): including identification, assessment, prioritization, treatment, and monitoring of security risks. Implement risk quantification models and dashboards (e.g., FAIR, GRC platforms). Embed risk management into project governance, third-party onboarding, and change management.
Regulatory Compliance &amp; Audit Readiness - Ensure compliance with global and regional security and privacy regulations including: UAE PDPL, KSA PDPL, EU GDPR, PCI-DSS, ISO 27001/22301. Lead internal and external audits, including Group ISO certification efforts, customer security reviews, and regulatory inspections. Maintain audit evidence repository and collaborate with Internal Audit and Legal for closure of issues and recommendations.
Third-Party Risk Management - Own the end-to-end Third-Party Cybersecurity Risk Management (TPCRM) program. Define onboarding requirements, due diligence controls, contract clauses, and periodic reassessments. Collaborate with Procurement and Legal to ensure security risks are addressed during partner lifecycle.
Awareness &amp; Training - Lead cybersecurity awareness and compliance education programs across the Group, including campaigns, simulated phishing, and executive training. Customize programs for different roles, departments, and markets to increase engagement and accountability.
GRC Technology &amp; Automation - Manage the Group&rsquo;s GRC platform. Integrate GRC systems with ITSM, Risk Registers, and Incident Management platforms. Continuously improve metrics, dashboards, and workflow automation for GRC lifecycle efficiency.
What You&rsquo;ll Need To Succeed
<ul><li>Bachelor&rsquo;s or Master&rsquo;s degree in Cybersecurity, Information Assurance, Law, Risk Management, or a related field.
</li><li>Relevant certifications strongly preferred: CISM, CRISC, CGEIT, CISSP, ISO 27001 Lead Auditor, ITIL, or equivalent.
</li><li>12+ years of progressive experience in cybersecurity or technology risk, with 5+ years in a senior GRC leadership role in a global enterprise or regional conglomerate.
</li><li>Strong understanding of Middle East regulatory requirements and global data protection laws.
</li><li>Proven track record managing multi-audit environments, cross-border compliance, and stakeholder engagement at C-level.</li></ul>
What We Can Offer You
With us, you will turn your aspirations into reality. We will help shape your journey through enriching experiences, learning and development opportunities and exposure to different assignments within your role or through internal mobility. Our Group offers diverse career paths for those who are extraordinary, every day.
We recognise the value that you bring, and we strive to provide a competitive benefits package which includes health care, child education contribution, remote and flexible working policies as well as exclusive employee discounts.
We Invite All Applicants to Apply
It Takes Diversity Of Thought, Culture, Background, Differing Abilities and Perspectives to truly Inspire, Exhilarate and Delight our customers. At Chalhoub Group, we are committed to inclusion and diversity.
We welcome all applicants to apply and be part of our exciting future. We ensure equal opportunity for all our applicants without regard to gender, age, race, religion, national origin or disability status.</div>

Director of Information Security - GRC (Governance, Risk & Compliance)

Metropolitan Community College (Neb.)

<div>Classification
Regular
Minimum Pay
$95,241.00
Compensation will be commensurate with the level of the position, education, and experience.
JOB DESCRIPTION SUMMARY
This position offers a competitive salary commensurate with experience and qualifications. In addition, we provide a comprehensive benefits package that supports your health, well-being, and professional growth
 
 
The Director of IT Cybersecurity, Risk and Compliance provides leadership in cybersecurity and responsible for the assessing and documenting of the College&rsquo;s compliance and risk posture as they relate to the ITS information assets. This role leads the development, implementation, and continuous improvement of a comprehensive cybersecurity and information security risk management program. This position provides highly technical and information security expertise proactively identifying emerging threats and driving mitigation strategies. The Director oversees the enforcement of internal security policies and procedures and manages user system access and identity management based on industry-standard best practices and compliance requirements, manages 3rd party risks, and provides input for data governance.
ESSENTIAL POSITION FUNCTIONS:
Leadership
<ul><li>Demonstrates leadership in ethical and practical compliance to enhance institutional trust, strengthen reputation, and support risk-informed decision-making.
</li><li>Promotes ethical business practices across the College by providing comprehensive education and establishing procedures to achieve the highest standards of compliance.
</li><li>Maintains the College&rsquo;s goals, culture, data collection, data storage, data processing, and data reported.
</li><li>Recommends programmatic and technical strategies, demonstrating a high level of independence in conducting investigations while upholding confidentiality and assessing the impact and analysis of security incidents, as well as making informed decisions regarding risk management and implementing computer and network security measures.
</li></ul>Cybersecurity
<ul><li>Establishes and maintains the College&rsquo;s cybersecurity governance model, including policies, standards, risk oversight, and performance reporting to senior leadership.
</li><li>Develops and maintains security metrics and dashboards (risk posture, compliance status, control health, vulnerability trends, training completion, and audit remediation status).
</li><li>Provides senior level guidance on cybersecurity priorities and risk acceptance decisions while communicating risk in clear business terms.
</li></ul>Risk
<ul><li>Leads the development and implementation of the system-wide risk management function of the information security program to ensure information security risks are identified and monitored.
</li><li>Internally assesses, evaluates and makes recommendations to management regarding the adequacy of the security controls for the College's information and technology systems.
</li></ul>Compliance
<ul><li>Leads the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies and regulations.
</li><li>Develops and implements effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.
</li><li>Executes strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors, PCI DSS, FERPA, HIPAA, NIST 800-171,GDPR, and GLBA safeguards.
</li></ul>Outreach / Awareness
<ul><li>Interacts in both oral and written communications with all levels of System staff including; computer support staff, developers and other ITS staff, Enrollment Services, Financial Aid, Instructional Design Services, Finance, General Counsel, MCC Police, auditors, and all system staff and students, technology vendors and contractors, in matters related to information security and security awareness materials.
</li><li>Coordinates cyber readiness and resilience activities with business continuity and disaster recovery planning, including recovery testing and restoration validation.
</li><li>Oversees governance for identity and access management (IAM) and privileged access controls in collaboration with IT teams, ensuring least privilege and compliance-driven access practices
</li><li>Develops strategies to address awareness and training for all stakeholders as well as technical solutions.
</li></ul>Audit
<ul><li>Works with College Financial office, and outside consultants as appropriate on required security assessments and audits.
</li><li>Coordinates and tracks all information technology and security related audits including scope of audits, colleges/units involved, timelines, auditing agencies and outcomes. Work with auditors as appropriate to keep audit focus in scope, maintain excellent relationships with audit. Provide guidance, evaluation and advocacy on audit responses.
</li><li>Consistently and dependably attends work, activities, and functions as scheduled or assigned.
</li></ul>KNOWLEDGE, SKILLS AND ABILITIES:
<ul><li>Knowledge of cybersecurity governance and risk management frameworks, including establishing strategy, roles, policies, and oversight.
</li><li>Knowledge of NIST CSF 2.0 and ability to implement and report using the six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.
</li><li>Ability to lead incident management and coordination, including communication, mitigation, and continuous improvement.
</li><li>Knowledge and understanding of campus policy development and dissemination.
</li><li>Must be familiar with policies affecting the higher education environment in the following areas of Student Privacy, Health Care, Finance, Institutional Research and State/Federal Regulations.
</li><li>Possess skills needed to assess computer hardware, software, and network systems for security risks or violations and work with ITS and campus staff and technology vendors to recommend solutions.
</li><li>Excellent interpersonal, communication, and presentation skills, including formal report writing.
</li><li>Possess strong customer service skills and the ability to project that attitude to customers in remote locations.
</li><li>Ability to assess the status of complex multi-location projects as well as identify and implement appropriate corrective measures to resolve issues as they arise.
</li><li>Ability to operate with a high degree of independence with regard to project management activities, including development of project plans and budget/resource estimates that align with mission.
</li><li>Ability to develop security standards and guidelines based on best practices and industry standards.
</li><li>Ability to effectively work and interact with various cultures and ethnicities.
</li></ul>MINIMUM QUALIFICATIONS FOR EDUCATION AND EXPERIENCE:
<ul><li>Bachelor&rsquo;s Degree in Information Technology or related field.
</li><li>Seven (7) years of full-time related work experience to include communicating, analyzing and responding to information security incidents.
</li><li>Experience planning and managing projects required.
</li><li>Information security experience in a higher education or state/local government environment preferred.
</li><li>CISM or CISSP preferred.
</li><li>Equivalent combination of education and/or work experience considered.
</li><li>Must pass a background check.
</li></ul>The specific statements shown in each section of this description are not intended to be all inclusive. They represent typical elements and criteria considered necessary to perform the job successfully. Metropolitan Community College recognizes that an individual with a disability may require an accommodation to enable the candidate to successfully perform a job function. Consideration will be given to reasonable accommodations .</div>

Director of IT Cybersecurity, Risk and Compliance

Search 10000+ Cybersecurity risk manager jobs near you this March. New roles added regularly across leading industries. Apply today.