information security manager

Bit Development Pvt Ltd

Information Security Manager<ul><li>Location: Karachi, Pakistan (Fulltime Onsite)</li><li>Reporting to: Director IT/InfoSec</li><li>Experience: 10+ years</li><li>Language: Outstanding Written and Spoken English Skills</li></ul>Summary:We are seeking a skilled, experienced, and collaborative leader of Information Security to lead our information security team based in Karachi. This individual will manage a team of security professionals and play a key role in operating our Security Operations Center (SOC), securing the enterprise environment, supporting compliance efforts (ISO 27001 and SOC 2), and driving continuous improvement in our security posture.The ideal candidate combines strong technical expertise with sound risk judgment; focusing on prioritizing and addressing risks in a balanced, business-aligned manner over default patching of automated scan findings. This role emphasizes pragmatic, continuous security improvement over idealism, and requires a leadership style grounded in trust, mentorship, and team growth. This role offers global visibility and requires close coordination with cross-functional stakeholders across regions to continually mature our security posture and risk management practices.Key Responsibilities:<ul><li>Lead and mentor a team of information security professionals promoting learning, collaboration and professional development.</li><li>Implement security controls, risk assessment framework, and programs that align to best practices and regulatory requirements.</li><li>Advise and recommend improvements to the design, development and expansion of ISMS across the global organization consistent with business needs and capabilities.</li><li>Support the implementation and maintenance of the Information Security Management System (ISMS).</li><li>Ensure timely identification, communication, and remediation of security risks and issues.</li><li>Oversee vulnerability management efforts with a focus on contextual risk analysis&mdash;ensuring findings are prioritized based on business impact and not automatically relayed scan outputs.</li><li>Balance risk identification and treatment with business capabilities and resources.</li><li>Conduct and oversee third-party risk assessments, including vendor assessments, control reviews and policy adherence.</li><li>Provide global security governance support, including preparation of stakeholder reports and communication of security posture.</li><li>Measure and analyze control effectiveness; identify and develop relevant metrics; report findings and lead remediation tracking efforts.</li><li>Champion security initiatives across the enterprise.</li></ul>Required Qualifications:<ul><li>10+ years of progressive experience in Information Security, with at least 5 years in a leadership role managing global or internationally alligned teams.</li><li>Track record of successfully supporting or leading security programs for ISO 27001 and SOC 2 compliance within a service provider or B2B environment.</li><li>Led or materially contributed to the implementation and audit-readiness of security frameworks (ISO 27001, NIST CSF, SOC 2) across multiple geographies.</li><li>Hands-on experience analyzing risk, assessing requirements, and remediating findings in high-compliance environments.</li><li>Proven experience leading vulnerability management with a focus on contextual risk analysis going beyond scan output to prioritize and drive remediation based on business impact.</li><li>Experience partnering with enterprise IT, legal, and compliance teams to operationalize security controls and improve governance maturity.</li><li>Relevant industry certification such as ISO 27001 Lead Auditor, CISSP / CISA / CISM / CCSP etc. (at least two) is highly desirable.</li></ul>Knowledge:<ul><li>Broad level of knowledge of security and risk issues and techniques across platforms.</li><li>Deep understanding of security frameworks: ISO 27001:2013, NIST CSF, SOC 2, PCI DSS, MITRE ATT&amp;CK, etc.</li><li>Strong technical knowledge of core security technologies: DLP, EDR, CASB, NGAV, WAF, email security, firewalls, PAM, etc.</li><li>Experience with cyber and cloud security operations, controls, and architecture.</li><li>Familiarity with IS audit and risk assessment practices and methodologies.</li></ul>Job Type: Full-timePay: Up to Rs550,000.00 per monthWork Location: In person

Information Security Manager

FinWise Bank

<div><ul><li>This position will be in office at our Murray, Utah location.</li></ul>
FinWise Bank is a commercial institution located in Murray, Utah that offers exceptional products in a manner that continually surpasses expectations. Information Security is a vital part of the Bank&rsquo;s structure, and the Risk and Compliance Division supports the Bank in these efforts. The Information Security Manager will work closely with the VP, Information Security Officer (ISO) to promote Information Security standards, controls, and best practices across the Bank. This role will be responsible for monitoring the security posture of Strategic Partners, conducting due diligence reviews of third parties with access to the Bank&rsquo;s sensitive data. This role will also have oversight activities of the Information Technology Division. This will be accomplished by monitoring security measures for the protection of computing networks and data delivery systems used throughout the Bank.
Tasks:<ul><li>
Serve as the primary point of contact between the Bank and assigned Strategic Partners for all matters related to Information Security.</li><li>
Provide visibility to the ISO about the security posture of assigned Strategic Partners.</li><li>
Monitor that assigned Strategic Partners are providing expected oversight documentation.
</li><li>Escalate all assigned Strategic Partner issues to the ISO.</li><li>
Participate in annual virtual or onsite visits of assigned Strategic Partners.</li><li>
Review policies, plans, procedures, security assessments, monitoring alerts, architectural diagrams, testing results, and audits from assigned Strategic Partners to ensure compliance with applicable banking regulations using a risk-based approach.</li><li>
Develop strong and collaborative professional relationships with Program Management, Vendor Management, IT teams at FinWise Bank as well as counterparts at Strategic Partners.</li><li>
Review and assess the security posture of third parties by evaluating submitted evidence and requesting additional documentation when appropriate.</li><li>
Create, modify, and enhance Information Security procedures and provide them to the ISO for review and approval.</li><li>
Execute assigned Information Security tasks in a timely manner.</li><li>
Escalate observed security issues, control gaps, or deficient third parties to the ISO.</li><li>
Complete user access reviews of assigned Bank systems.</li><li>
Conduct clean desk reviews at Bank premises.
</li><li>Conduct investigations of security incidents leveraging the Bank&rsquo;s security tools.
</li><li>Ensure that security incidents associated with the Bank, third parties, or Strategic Partners are documented.
</li><li>Other duties as assigned.</li></ul>
Knowledge, Skills, and Abilities:<ul><li>
Manage concurrent activities with tight deliverables and a strong attention to detail.
</li><li>Ability to handle highly confidential information and material in a professional manner.</li><li>
Ability to communicate technical information in a manner comprehensible by individuals at varying degrees of experience and skill levels.</li><li>
Outstanding technical security background as well as thorough understanding of relevant risk mitigation and technical controls following industry best practices from NIST, CIS, etc.</li><li>
Direct experience with controls related to Information Security as defined by the FFIEC, FDIC, GLBA, SEC, SOX, PCI-DSS.</li><li>
Demonstrate and apply a thorough understanding of Third-Party Risk Management, with specific focus on cyber security, data protection, business resiliency, and other security risks associated with the use or technology (e.g.: cloud, API, IT infrastructure, external audits, BCP/DR, and operational security functions).</li><li>
Ability to assess and review third-party audit evidence from Strategic Partners such as: SOC reports, Penetration Testing reports, ITGC audit reports, PCI DSS SAQ/AOC/ROC, cyber insurance policies, etc.</li><li>
Ability to evaluate and present clear business and technology recommendations to assigned Strategic Partners considering threats, vulnerabilities, risks, and Bank needs.</li><li>
Ability to remain aware of current security threats, trends, and topics to support the security posture of the Bank and Strategic Partners.</li><li>
Self-motivation and eagerness to learn.</li><li>
Excellent written and verbal communication skills.</li></ul>
Required Education / Experience / License:<ul><li>
BA/BS in a related subject (or equivalent professional experience)</li><li>
3+ years of experience in Information Security</li><li>
1+ years of experience in the financial services industry</li><li>
At least one entry-level security certification (e.g.: Security+, CCOA, SSCP, etc.)</li></ul>
Preferred Education / Experience / License:
<ul><li>Master&rsquo;s degree in a related subject</li><li>
At least one intermediate-level security certification (e.g.: CySA+, CISA, CCSP, etc.)</li><li>
At least one advanced-level security certification (e.g.: CASP+, CISM, CISSP, etc.)</li></ul>
Minimum Essential Requirements:
<ul><li>Sit or stand at a computer for extended periods of time and look at a computer screen for several hours a day.</li><li>
Work at an assigned FinWise office location.</li><li>
Communicate with others in person, on the phone, virtual meeting, and email.</li><li>
Maintain confidentiality.</li><li>
Lift 20 lbs.</li><li>
Maintain regular and punctual attendance.</li><li>
Work overtime as assigned.</li><li>
Travel overnight as required.</li><li>
Work cooperatively with others.</li><li>
Driving during the workday.</li><li>
Comply with all company policies and procedures.</li></ul>
Background checks are required on all Bank employees due to the accessibility of Personally Identifiable Information.
AAP/EEO Statement
FinWise is an equal opportunity employer and dedicated to diversity and inclusion in the workplace. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender identity, sexual orientation, age, marital status, pregnancy status, veteran status, or disability status.
FinWise provides reasonable accommodations to the known disabilities of individuals in compliance with the Americans with Disabilities Act. For accommodation information or if you need special accommodations to complete the application process, please contact the Human Resources Department at (801) 545 - 6041.
Qualified applicants with criminal history and conviction records will be considered in accordance with legal requirements.</div>

DCS Corp

<div><div>The Information System Security Manager is the principal information assurance professional responsible for maintaining the security posture of an accredited DoD system. 
Essential Job Functions:
The ISSM will provide support in the following areas:
Provide guidance to ISSOs, Information Technology team members, and the system owner regarding goals and objectives that will minimize the organizational risk present in the system.
Compose, distribute, and execute local policies and procedures that will ensure system compliance with DoD RMF controls. These policies include, but are not limited to:
Vulnerability management
POA&amp;M management
Personnel onboarding and offboarding
Incident response
Provide advisory to management regarding changes that may impact the security posture of the system. 
Required Skills:
Due to the sensitivity of customer related requirements, U.S. Citizenship is required.
Must be able to obtain and maintain a Secret clearance.
BS degree in Information Technology, Cybersecurity, Data Science, Information Systems or Computer Science with 12 years of experience.
Excellent written and verbal communication skills
Strong familiarity with NIST publications
Understanding of common operating systems, network technologies, risk management frameworks, and security tools<div><div>
Certification required for IAM level II or III appointment:</div><ul><li>CAP</li><li>CASP+ CE</li><li>CISM</li><li>CISSP</li><li>GSLC</li><li>CCISO</li><li>HCISPP</li><li>CISM</li><li>CISSP</li><li>GSLC</li><li>CCISO</li></ul></div></div></div>

Information System Security Manager

RP International

<div>
 
 The
 
 IT Security Manager
 
 is responsible for leading the Network Security and Endpoint Security teams, ensuring the organization&rsquo;s IT systems and networks are protected from internal and external threats. This role encompasses strategic planning, technology implementation, operational management, and audit compliance, while ensuring the availability and reliability of security systems.
 
 
 
 
 
 
 Key Responsibilities
 
 
 
 
 Leadership &amp; Team Management
 
 
 <ul>
 <li>
 Lead, mentor, and manage the Network Security &amp; Endpoint Security teams.
 </li>
 <li>
 Foster a culture of accountability and commitment to user satisfaction and operational excellence.
 </li>
 <li>
 Ensure all team members are equipped to deliver high-quality results.
 </li>
 </ul>
 
 
 
 
 
 Security Operations &amp; System Management
 
 
 <ul>
 <li>
 Oversee administration, monitoring, and technical support of network and endpoint security systems, including but not limited to:
 </li>
 <li>
 Firewalls, Intrusion Prevention Systems (IPS), Web Application Firewalls
 </li>
 <li>
 Internet Proxy/Web Filtering, DDoS Mitigation Systems
 </li>
 <li>
 Vulnerability Management, Patch Deployment, Antivirus, Universal Threat Management
 </li>
 <li>
 Application Control and other emerging security technologies
 </li>
 <li>
 Conduct regular system health checks, performance monitoring, and capacity planning.
 </li>
 <li>
 Ensure 24x7 availability of critical security systems.
 </li>
 <li>
 Supervise backup, patching, updates, upgrades, and DR failover/failback testing.
 </li>
 <li>
 Manage AMC renewals for systems and infrastructure.
 </li>
 </ul>
 
 
 
 
 
 Audit &amp; Compliance
 
 
 <ul>
 <li>
 Coordinate and support internal, external, and regulatory audits of IT security systems.
 </li>
 <li>
 Ensure documentation, procedures, and management reports are accurate, updated, and compliant with standards.
 </li>
 </ul>
 
 
 
 
 
 Reporting &amp; Continuous Improvement
 
 
 <ul>
 <li>
 Implement MIS reporting for all security systems and review reports periodically.
 </li>
 <li>
 Communicate progress, issues, and updates to IT leadership.
 </li>
 <li>
 Identify risks, implement corrective actions, and resolve issues proactively.
 </li>
 <li>
 Collaborate with internal teams and external vendors for system enhancements or issue resolution.
 </li>
 </ul>
 
 
 
 
 
 Required Qualifications &amp; Experience
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in Computer Science, Information Systems, or equivalent IT discipline.
 </li>
 <li>
 10&ndash;12 years of IT experience, with at least 7 years in IT security operations.
 </li>
 <li>
 Master&rsquo;s degree in Cybersecurity is a plus.
 </li>
 </ul>
 
 
 
 
 
 Certifications (at least 2 required):
 
 
 <ul>
 <li>
 CISSP, CISM, CISA, GIAC, CEH, CRISC, or equivalent.
 </li>
 </ul>
 
 
 
 
 
 Technical Skills:
 
 
 <ul>
 <li>
 Strong expertise in security systems, including firewall/VPN, IDS/IPS, DDoS, proxy/content filtering, endpoint &amp; data security.
 </li>
 <li>
 Hands-on experience in vulnerability management and patch deployment.
 </li>
 <li>
 Solid understanding of LAN/WAN networking, TCP/IP, network protocols, intranet/internet technologies.
 </li>
 <li>
 Knowledge of security standards such as ISO 27001, ISO 27005, PCI-DSS, CoBIT.
 </li>
 <li>
 Experience in security event monitoring, reporting, and MIS documentation.
 </li>
 </ul>
 
 
</div>

Information Technology Security Manager

SMS Data Products Group, Inc

<div>Overview: 
As a dynamic systems integrator, SMS offers proven solutions in engineering, operations, cybersecurity, and digital transformation. With expertise in modernizing and optimizing legacy infrastructure and systems, ensuring operational efficiency, and designing, implementing, and managing secure environments, SMS supports business and mission goals with proficiency, quality, and integrity. 
SMS has been serving the advanced information technology needs of the federal government since 1976, delivering talented teams and innovative, cost-effective solutions and services to support our customers&rsquo; missions for more than 45 years. SMS is headquartered in McLean, Virginia, with offices and on-site operations at customer locations throughout the United States. For additional information on SMS, visit www.sms.com.<div> 
Submit your resume today!</div>
Responsibilities:
<ul><li>Provide cybersecurity/information security technical advice to the USAFCENT Authorizing Official (AO), and oversee and direct related cybersecurity policies, research, governance, risk management and compliance activities.</li><li>
Research, analyze, document and write systems security accreditation and certification requirement packages in accordance with applicable Air Force regulations and procedures; including documenting systems architecture and networks&rsquo; physical layout in writing and graphical presentations.</li><li>
Analyze, evaluate, and recommend the application of Air Force systems accreditation and certification procedures in relation to existing and planned AFCENT network architecture at supported bases.</li><li>
Research, Process, approve Firewall and Bluecoat Exception Request for implementation.</li><li>
Process request for removable storage, such as write to CD, USB for US and FNs.</li><li>
Complete accreditation documents for AFCENT as outlined by DISA Risk Management Framework (RMF), Cybersecurity Service Provider (CSSP), USCENTCOM, and Authorizing Official (AO) guidance to include documenting systems architecture and physical network layout in writing and graphical presentations.</li><li>
Maintain Enterprise Products List (EPL) and Accreditation Library for all approved products and systems and evaluate service level agreements.</li><li>
Assist with the completion of all accreditation documents for AFCENT Cross Domain Solutions.</li><li>
Research, analyze, and document information assurance and cybersecurity polices, regulations and guidance; and assist in interpreting local policies.</li><li>
Track, document, and report all security related events, including, but not limited to, Discharge of Classified Information and Cross Domain Violations IAW USCENTCOM/AFCENT policy.</li><li>
Coordinate and track Information Assurance Vulnerabilities Alerts (IAVA); review and report AFCENT compliance to USCENTCOM; and develop and implement associated Plans, Objectives, Actions and Milestones (POA&amp;Ms), as required.</li><li>
Provide General IT Management support.</li><li>
Provide General Networking support.</li><li>
Provide LAN support.</li><li>
Provide WAN Enterprise support.</li><li>
Provide documentation/reports support.</li><li>
Provide meetings/briefings support.</li><li>
Provide functional training support.</li><li>
Provide OCONUS deployment/TDY travel support.</li><li>
Provide CONUS TDY support as required</li></ul>
Qualifications:
<div>
Qualifications</div><ul><li>
B.S. in related field, and 5 or more years&rsquo; relevant Information Security experience or7 or more years&rsquo; relevant Information Security experience;</li><li>
Firewall experience</li><li>
Must possess experience and demonstrate an understanding of Risk Management Framework, National Institute of Technology and Standards (NIST) Cyber Framework, DoD and Service-level Instructions/Directives/Policies, and Cyber Security Regulations/Best Practices.</li><li>
Top Secret clearance required.</li><li>
CISSP - Required</li><li>
ITIL Foundation (candidate has up to 60 days to acquire ITIL Foundation certification.)</li></ul><div></div><div> 
SMS is a dynamic systems integrator established in 1976, delivering talented teams and innovative, cost-effective solutions and services to support our customers&rsquo; missions for more than 47 years. Our ability to hire and retain quality people in a rapidly evolving IT market is proven through our employee retention rate averaging over 3 years. At SMS, we place a high value on quality of service, customer satisfaction, and best-of-breed policies and practices, resulting in CMMI Level 3 certification and ISO registrations including 9001:2015, 20000-1:2018, and ISO/IEC 27001:2013. SMS is headquartered in McLean, Virginia, with offices and on-site operations at customer locations throughout the United States.</div><div></div><div> 
SMS is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.</div></div>

CACI International

<div>Information Systems Security Manager (ISSM)
Job Category: Information Technology
Time Type: Full time
Minimum Clearance Required to Start: Top Secret
Employee Type: Regular
Percentage of Travel Required: Up to 25%
Type of Travel: Continental US
* * *
Exciting Career Opportunity: Join Our Elite Cyber Security Team as an Information Systems Security Manager! 
Are you a seasoned cyber security expert looking for your next thrilling career challenge? CACI is on the hunt for an experienced Information Systems Security Manager to join our dynamic cyber security team. If you thrive in a mission-driven environment and are passionate about safeguarding critical systems, we want to hear from you! 
Responsibilities:
As our Information Systems Security Manager, you&rsquo;ll be the go-to Cyber Security subject matter expert, playing a pivotal role in both internal and external customer initiatives. Your responsibilities will include:<ul><li>
Overseeing Security Operations: Ensure systems are operated, maintained, and disposed of in line with security policies and procedures.</li><li>
Coordinating A&amp;A and CM: Manage Assess and Authorize (A&amp;A), Configuration Management (CM), and Release Management requirements according to DoD Instructions.</li><li>
Ensuring Security Compliance: Verify that changes to applications, systems, environments, or organizations do not compromise security posture.</li><li>
Monitoring Vulnerability Postures: Validate vulnerability postures in ACAS and ensure compliance with DISA STIGs and CSSP HBSS requirements.</li><li>
Submitting ATO Documentation: Prepare and submit Authority to Operate documentation to eMASS and XACTA.</li><li>
Conducting Assessments: Perform periodic assessments of authorized systems and provide corrective actions for identified findings and vulnerabilities.</li><li>
Analyzing Audit Records: Collect and analyze audit records in accordance with the security plan.</li><li>
Incident Reporting: Report security-related incidents to the Facility Security Officer and assist with formal reporting to customers and DCSA oversight.</li><li>
Continuous Monitoring: Develop and execute a continuous monitoring strategy.</li><li>
Cyber Security Training: Create and oversee a cyber security awareness training program.</li><li>
Travel: Visit other locations or customer sites as needed.</li><li>
Team Collaboration: Work effectively in a team environment and perform other duties as assigned.</li></ul> 
Qualifications: 
 
Required:<ul><li>
An active DoD TS/SCI security clearance.</li><li>
Advanced knowledge of IT and networking (IP Networking, cyber security, or software development).</li><li>
Advanced understanding of Windows Server, Active Directory, DHCP, DNS, and WSUS/SCCP.</li><li>
Proficiency in Microsoft Windows and Linux software applications.</li><li>
At least one active Department of Defense 8570.01-M IAT/IAM Level III certification (e.g., CASP+CE, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP, CISM, GSLC, CCISO).</li><li>
Education: B.S. in Information Technology/Systems, Computer Science, Computer Engineering, or Electrical Engineering.</li><li>
Experience: 5-7 years of related experience.<ul><li>
Understanding of system controls and their impact on system security.</li><li>
Minimum of 5 years monitoring system NIST compliance using workflow tools.</li><li>
Minimum of 3 years using eMASS for system certification and accreditation tracking.</li><li>
Minimum of 3 years transitioning to and operating within RMF in DoD applications.</li><li>
Experience in initial risk assessment and assisting Authorizing Official with risk determination and acceptance.</li></ul></li></ul>
Desired:<ul><li>
Experience as an ISSO/ISSM managing systems approved to process classified information.</li><li>
Knowledge of Air Force cyber security policies.</li><li>
Experience submitting ATO documentation in eMASS and Xacta.</li><li>
Willingness and ability to quickly learn new technologies.</li></ul>
Why Join Us?<ul><li>
Impactful Work: Contribute to a unique and vital mission.</li><li>
Professional Growth: Opportunities to learn and grow with cutting-edge technologies.</li><li>
Collaborative Environment: Work with a talented and dedicated team.</li><li>
Travel Opportunities: Explore new places while serving our customers.</li></ul>
Ready to take on a challenging and rewarding role? Apply now and become a key player in our cyber security success story!<ul><li> 
</li></ul>
________________________________________________________________________________________
What You Can Expect: 
A culture of integrity.
At CACI, we place character and innovation at the center of everything we do. As a valued team member, you&rsquo;ll be part of a high-performing group dedicated to our customer&rsquo;s missions and driven by a higher purpose &ndash; to ensure the safety of our nation. 
An environment of trust.
CACI values the unique contributions that every employee brings to our company and our customers - every day. You&rsquo;ll have the autonomy to take the time you need through a unique flexible time off benefit and have access to robust learning resources to make your ambitions a reality.
A focus on continuous growth.
Together, we will advance our nation's most critical missions, build on our lengthy track record of business success, and find opportunities to break new ground &mdash; in your career and in our legacy. 
Your potential is limitless. So is ours.
Learn more about CACI here.
________________________________________________________________________________________
Pay Range: There are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits. Learn more here.
The proposed salary range for this position is:
$85,800 - $180,200<div>
CACI is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any other protected characteristic.</div></div>

Information Systems Security Manager (ISSM)

San Francisco Department of Public Health

Recruitment: RTF0160817-01037161
 
Published: December 03, 2025
 
Contact: 
Marielle Francine Saldajeno - marielle.saldajeno@sfdph.org
 
Apply using SmartRecruiters, the City and County of San Francisco's application portal.
 
Share
 
Department: Public Health
 
Job class: 0933-Manager V
 
Starting salary range: $180,440.00 - $230,308.00 (Range A)
 Role type: Permanent Civil Service What does this mean?
 
Hours: Full-time
 
Exam type: Position Based Test
 
Rule: Rule of the List
 
List type: Combined Promotive and Entrance
 
About: 
The Department of Public Health prioritizes equitable and inclusive access to quality healthcare for its community and values the importance of diversity in its workforce. All employees at the Department of Public Health work to advance equity, inclusion, and diversity with a specific lens and focus on race, ethnicity, gender, sex, sexuality, disability, and immigration status.
 This is a Position-Based Test conducted in accordance with CSC Rule 111A . Learn more about the City’s hiring process here: https://careers.sf.gov/knowledge/process/
 Application Opening : Friday, November 21, 2025
 Application Deadline: Application filing will close on or after Friday, January 9, 2026.
 Salary : $180,440 - $230,308 Annually (Range A)
 Appointment Type : Permanent Civil Service
 Recruitment ID :  PBT-0933-160818
 Becoming a City employee means being a part of a team that cares about making a difference. Your work will shape both the present and future of San Francisco. When you work for the City, you’re choosing a job with purpose.
 The mission of the San Francisco Department of Public Health (SFDPH) is to protect and promote the health of all San Franciscans. SFDPH strives to achieve its mission through the work of several divisions - the San Francisco Health Network, Population Health Division, Behavioral Health Services, and Central Administration. The San Francisco Health Network is the City’s only complete system of care and has locations throughout the City, including Zuckerberg San Francisco General Hospital and Trauma Center, Laguna Honda Hospital and Rehabilitation Center, and over 15 primary care health centers. The Population Health Division (PHD) provides core public health services for the City and County of San Francisco: health protection, health promotion, disease and injury prevention, disease surveillance, and disaster preparedness and response. Behavioral Health Services operates in conjunction with SFHN and provides a range of mental health and substance use treatment services. Central Administration houses core support organizations, including Finance, Information Technology (IT), Human Resources, Privacy and Compliance, Business Office, Facilities Management, and Security Services.
 
Role description
 
The San Francisco Department of Public Health is seeking a dynamic and experienced cybersecurity professional to join its IT leadership team. As a key strategic leader, the Chief Information Security Officer (CISO) (0933 Manager V) will be responsible for developing and executing a comprehensive information security strategy that safeguards the department’s systems, data, and services.
 This role leads the implementation of an enterprise-wide security program that promotes collaboration, strengthens governance, and aligns cybersecurity initiatives with organizational goals. The CISO serves as a trusted advisor to senior leadership, providing expert guidance on risk management, security investments, and policy development. The CISO oversees a team of cybersecurity professionals within the SFDPH IT division and collaborates extensively with the CISO for the City and County of San Francisco.
 We are looking for a visionary and collaborative leader who can balance innovation with risk mitigation, and who thrives in a complex, mission-driven environment. The CISO reports directly to the Chief Information Officer (CIO).
 The Chief Information Security Officer (0933 Manager V) performs the following essential job functions:
 Provides strategic leadership in evaluating and mitigating information security threats across the organization using a structured, risk-based methodology. Advises executive leadership on identified risks and ensures timely execution of mitigation and remediation plans with integrity and discretion
 Directs the ongoing development of the department’s information security program, including project portfolio management, incident response, policy frameworks, compliance activities, threat and vulnerability management, and third-party risk management
 Allocates and manages resources to support a robust security strategy. Identifies and advocates for strategic investments, oversees capital and operating budgets, and delivers ROI analyses and budget recommendations
 Partners with the Office of Compliance and Privacy Affairs to assess data security risks related to contracts, projects, artificial intelligence solutions, and other initiatives. Develops tools and interventions to mitigate risks, establishes performance metrics, and monitors compliance through audits and assessments
 Builds alignment and support for security goals and initiatives across internal and external stakeholders. Communicates effectively with leadership at all levels on trends, risks, and the overall effectiveness of the security program
 Promotes awareness and understanding of regulatory requirements across the organization. Leads or collaborates on testing and auditing activities to ensure ongoing compliance and successful certifications
 Analyzes security requirements and ensures compliance with industry standards such as HIPAA, NIST, and PCI-DSS
 Establishes and maintains comprehensive policies and procedures to support effective and sustainable security operations
 Serves as the department’s representative in security-related matters with City agencies and partners
 Continuously monitors emerging trends, technologies, and best practices in cybersecurity to ensure the department’s security posture remains current and effective
 The Chief Information Security Officer (0933 Manager V) may perform other duties as assigned/required.
 
How to qualify
 
1. Education : Bachelor’s degree from an accredited college or university; AND
 ​​2. Experience : Five (5) years of professional healthcare information systems security experience, of which three (3) years must include supervising IT professionals.
 
Education Substitution: Additional experience as described above may be substituted for the required degree on a year-for-year basis. One (1) year is equivalent to thirty (30) semester units / forty-five (45) quarter units.
 Applicants must meet the minimum qualification requirements by the final filing date unless otherwise noted.
 One-year full-time employment is equivalent to 2,000 hours (2,000 hours of qualifying work experience is based on a 40-hour work week).
 
Desirable Qualifications: 
The stated desirable qualifications may be considered at the end of the selection process when candidates are referred for hiring:
 Possession of a Certified Information Systems Security Professional (CISSP) and/or Certified Information Security Manager (CISM) certification
 
Verification of Education and Experience: 
Every application is reviewed to ensure that you meet the minimum qualifications as listed in the job ad. Review SF Careers Employment Applications for considerations taken when reviewing applications.
 Applicants may be required to submit verification of qualifying education and experience at any point during the recruitment and selection process. If education verification is required, information on how to verify education requirements, including verifying foreign education credits or degree equivalency, can be found at https://careers.sf.gov/knowledge/experience-education/ .
 Note: Falsifying one’s education, training, or work experience or attempted deception on the application may result in disqualification for this and future job opportunities with the City and County of San Francisco.
 
What else should I know?
 
Selection Procedures: 
After application submission, candidates deemed qualified must complete all subsequent steps to advance in this selection process, which includes the following:
 Supplemental Questionnaire (SQ) Examination (Weight: 100%)
 
Candidates that meet the minimum qualifications will be invited to participate in a Supplemental Questionnaire (SQ) examination that is designed to measure the knowledge, skills, and abilities in job related areas which may include but not be limited to: Knowledge of local, State and Federals laws and regulations relating to information security, including but not limited to HIPAA and HITECH; Knowledge of information security technology frameworks and standards, including but not limited to NIST, HITRUST, COBIT, ISO 27001, PCI-DSS or similar cyber security frameworks; Knowledge of technology relating to enterprise wide information security protection; Knowledge of structured systems analysis and design practices and techniques; common operating systems software and relational database systems; hospitals or community health network environments; Ability to apply principles and practices of management, administration, budgeting, training, and personnel management; Ability to manage, supervise, train and coordinate complex functional area of responsibility and groups of employees; Ability to analyze and report on activities, issues and problems and recommend appropriate solutions; Ability to communicate effectively orally; Ability to communicate effectively in writing; Ability to exercise judgement, decisiveness and creativity required in situations involving the direction, control and planning of a program(s); manage critical timelines effectively; Ability to establish and maintain good working relationships with department personnel, staff, vendors, peers, and management, and engage and influence a broad range of stakeholders (e.g. HR, IT, Legal, Compliance, senior management, etc.)
 Candidates must achieve a passing score on the Supplemental Questionnaire exam in order to continue in the selection process and will be placed on the confidential eligible list in rank order according to their final score.
 Additional selection processes may be conducted by the hiring department prior to making final hiring decisions.
 Certification
 
The certification rule for the eligible list resulting from this examination will be the Rule of the List.
 
Eligible List/Score Report : 
A confidential eligible list of applicant names that have passed the civil service examination process will be created and used for certification purposes only. An examination score report will be established, so applicants can view the ranks, final scores, and number of eligible candidates. Applicant information, including names of applicants on the eligible list, shall not be made public unless required by law. However, an eligible list shall be made available for public inspection, upon request, once the eligible list is exhausted or expired and referrals resolved. The eligible list/score report resulting from this civil service examination process is subject to change after adoption (e.g., as a result of appeals), as directed by the Human Resources Director or the Civil Service Commission.
 The duration of the eligible list resulting from this examination process will be of six months and may be extended with the approval of the Human Resources Director.
 To find Departments which use this classification, please see the city’s Position Counts by Job Codes and Departments.
 
Terms of Announcement and Appeal Rights : 
Applicants must be guided solely by the provisions of this announcement, including requirements, time periods and other particulars, except when superseded by federal, state or local laws, rules, or regulations. Clerical errors may be corrected by the posting the correction on the Department of Human Resources website at https://careers.sf.gov/ .
 The terms of this announcement may be appealed under Civil Service Rule 111A.35.1. The standard for the review of such appeals is ‘abuse of discretion’ or ‘no rational basis’ for establishing the position description, the minimum qualifications and/or the certification rule. Appeals must include a written statement of the item(s) being contested and the specific reason(s) why the cited item(s) constitute(s) abuse of discretion by the Human Resources Director. Appeals must be submitted directly to the Executive Officer of the Civil Service Commission within five business days of the announcement issuance date.
 Additional information regarding Employment with the City and County of San Francisco:
 Information about the Hiring Process
 Conviction History
 Employee Benefits Overview
 Equal Employment Opportunity
 Disaster Service Workers
 ADA Accommodation
 Right to Work
 Copies of Application Documents
 Diversity Statement
 Veterans Preference
 Seniority Credit in Promotional Exams
 Where to Apply
 
All job applications for the City and County of San Francisco must be submitted through our online portal. Please visit https://careers.sf.gov/ to begin your application process.
 Applicants may be contacted by email about this recruitment. Please consider using a personal email address that you check regularly rather than a work or school account.
 Computers are available for the public (9:00 a.m. to 4:00 p.m. Monday through Friday) to file online applications in the lobby of the Dept. of Human Resources at 1 South Van Ness Avenue, 4th Floor and at the City Career Center at City Hall , 1 Dr. Carlton B. Goodlett Place, Room 110.
 Ensure your application information is accurate, as changes may not be possible after submission. Your first and last name must match your legal ID for verification, and preferred names can be included in parentheses. Use your personal email address, not a shared or work email, to avoid unfixable issues.
 Applicants will receive a confirmation email from notification@smartrecruiters.com that their online application has been received in response to every announcement for which they file. Applicants should retain this confirmation email for their records. Failure to receive this email means that the online application was not submitted or received.
 If you have any questions regarding this recruitment or application process, please contact the analyst, Marielle Saldajeno at marielle.saldajeno@sfdph.org or (628) 271-6820 .
 We may use text messaging to communicate with you on the phone number provided in your application. The first message will ask you to opt in to text messaging.
 The City and County of San Francisco encourages women, minorities and persons with disabilities to apply. Applicants will be considered regardless of their sex, race, age, religion, color, national origin, ancestry, physical disability, mental disability, medical condition (associated with cancer, a history of cancer, or genetic characteristics), HIV/AIDS status, genetic information, marital status, sexual orientation, gender, gender identity, gender expression, military and veteran status, or other protected category under the law.

Chief Information Security Officer (0933 Manager V) - Department of Public Health

Search 10000+ Information security manager jobs near you this December. New roles added regularly across leading industries. Apply today.

10000 information security manager jobs NEAR_ME

Information Security Manager

Information Security Manager

Information System Security Manager

Information Technology Security Manager

Information System Security Manager

Information Systems Security Manager (ISSM)

Chief Information Security Officer (0933 Manager V) - Department of Public Health