Information Security Manager ONI

Responsibilities include, but are not limited to, the following:

Security Governance, Risk and Compliance

• Operate and mature the enterprise security program in partnership with the Director of IT, aligning security investments and projects to identified risks and business requirements.
• Direct recurring risk assessments and control audits across ONI and its affiliate companies; maintain the enterprise risk register and drive remediation items to closure.
• Develop, maintain, and socialize security policies, standards, and procedures, mapping controls to a recognized framework (NIST 800-53, NIST SP 800-171, and or CMMC) and keeping documentation audit-ready.
• Own responses to customer security questionnaires, cyber insurance applications and attestations, and contractual or regulatory security obligations (e.g., CMMC, customer-specific requirements).
• Assist resource owners and IT staff at affiliate companies in understanding and remediating security audit findings reported by internal and external auditors.

Threat Detection, Incident Response and Security Operations

• Manage high-severity incident response end to end, including triage, containment, forensic analysis, executive communication, and post-incident review.
• Maintain and regularly test the incident response plan and supporting playbooks; coordinate tabletop exercises with IT and business leadership.
• Direct the operational management of vulnerability management, SIEM and managed detection and response services, threat intelligence platforms, and dark web monitoring.
• Manage MSSP and security vendor performance against service levels, escalating and remediating gaps in coverage or responsiveness.

Security Architecture and Technology

• Ensure consistent application of security standards and provide configuration guidance and change control for firewall, asset management, endpoint, and backup and recovery systems.
• Strengthen identity and cloud security across the Microsoft estate, including Active Directory and Entra , Conditional Access, privileged access management, Microsoft Defender, Intune, and overall Microsoft 365 and SaaS security posture.
• Partner with plant and operations leadership to extend asset visibility, network segmentation, and monitoring into OT/ICS and manufacturing environments, accounting for the availability and safety constraints unique to plant-floor systems.
• Evaluate, pilot, and recommend new security technologies, and lead their implementation across ONI and affiliate environments.

Data Protection and Emerging Technology Governance

• Lead data classification, data loss prevention, and insider risk initiatives, prioritizing protection of the company's most sensitive business and customer information.
• Establish and maintain governance for artificial intelligence and other emerging technologies, including acceptable use standards, data handling requirements, vendor and model review, and monitoring for unsanctioned tool usage.

Third-Party and Vendor Risk

• Oversee third-party risk assessments, including vendor due diligence, security and privacy terms in contracts, and ongoing monitoring of critical suppliers and service providers.
• Maintain an inventory of third parties with access to ONI systems or data, along with the assessed risk associated with each.

Leadership, Awareness and Reporting

• Supervise the Cybersecurity Engineer and other assigned security staff — setting objectives, guiding performance, and supporting professional development.
• Manage the delivery and measure the effectiveness of security awareness and training programs, including phishing simulation and role-based training.
• Lead the reporting and analysis of cybersecurity metrics and KPIs for both operational and executive audiences, including periodic updates to senior leadership.
• Lead cross-functional project teams, defining scope, schedule, and resource requirements, and delivering security projects on time and on budget.

Required Skills, Abilities and Education

• A minimum of five years of IT experience, including at least three years in a dedicated information security role and at least two years in a supervisory or team-lead capacity.
• Bachelor's degree or higher in Cybersecurity, Information Security, Information Systems, Engineering, Computer Science, or a related field of study. Equivalent experience combined with relevant certification will be considered.
• Demonstrated experience in risk assessment, incident management, and project management.
• Working knowledge of a recognized security framework (NIST 800-53,…