Cybersecurity Program Manager

Core Cybersecurity Program Management Capabilities

Primary duties, execution frameworks, and fundamental skill set of the cybersecurity program manager role:

1. IT Security Control Set Administration: Direct responsibility for approximately 40% of the control set and 60% oversight across remaining controls, performing annual control updates and alignment recommendations.
2. Policies, Procedures & Standards: Maintain and annually review 30+ IT security policies with the CISO, CIO, and CTO, managing internal distribution, intranet publishing, and off-site disaster recovery storage.
3. Cybersecurity Risk Register (OneTrust): Maintain risk register functionality, execute risk treatment plans from identification to remediation, conduct annual internal risk assessments, and educate stakeholders on organizational risk posture.
4. Client Security Risk Requirements: Author responses to client risk/security assessment questionnaires, negotiate redline security contracts, track required security remediations, and maintain client control matrices.
5. Vendor Security Risk Assessments: Oversee third-party vendor assessments via the OneTrust portal, inform stakeholders on vendor risk postures, and conduct annual vendor security audits.
6. Security Architecture & Audit Assurance: Partner with architecture teams on application and infrastructure projects to guarantee architectural compliance for SOC 2 Type II, ITGC, and HITRUST audit pass rates.
7. Vulnerability Management (Rapid7 & Azure): Chair weekly critical vulnerability reviews, direct operational patching efforts, and report remediation outcomes using Rapid7 and Azure Security Cloud.
8. Role-Based Access Control (RBAC) & Governance: Enforce strict RBAC policies ensuring termination/role access revocation within 24 hours, administer Access Auditor software, and conduct quarterly access rights reviews.
9. Phishing Campaigns & Awareness Training: Design, execute, and report on monthly phishing simulation campaigns using KnowBe4 and Terranova platforms.
10. Security Onboarding & Compliance Training: Curate annual cybersecurity awareness content, enforce mandatory completion tracking, and manage access restriction policies for non-compliant personnel.
11. IT Internal Audits (SOC 2, ITGC, HITRUST): Plan and execute internal audits against required security controls to ensure seamless annual certification success.
12. Investigations & Incident Response: Lead investigations on security alarms/audit findings, manage the security incident handling lifecycle, and partner with legal/management on policy violation enforcement.
13. Capability Maturity Model (CMMI & COBIT): Provide COBIT-based guidance to elevate organizational cybersecurity maturity from CMMI Level 2 to Level 3 capabilities.