Information Security Manager

Overview

Engage is a business unit within Precisely Software Incorporated, which produces a suite of SaaS and on-prem software products that handle personal data. We are looking for a Business Information Security Officer with experience aligning product design and delivery to information security compliance frameworks and privacy regulations. As part of the R&D team, the Business Information Security Officer will manage a team who are responsible for overseeing a range of technical and process security controls.

You will operate as one of several business unit and functional Business Information Security Officers and work within the Federated Infosec and Governance architecture under the guidance and governance frameworks of the Precisely Chief Information Security Officer and Chief Privacy Officer. You will be expected to align and maintain controls within the Precisely information security management system. They will ensure compliance to company information security policies and efficacy of standard controls.

You will work with the Precisely Info Sec Compliance and Privacy teams as well as Precisely’s external auditors to maintain current and future certification to compliance frameworks and regulations. You will work with internal product management, product development and professional services teams to ensure that team practices are in line with policies and will communicate the security risks to Precisely Info Sec risk boards and management.

The role requires a thorough understanding of the technology underpinning the Engage software products, as well as a broad, up-to-date knowledge of information security frameworks, pertinent regulation and legislation, vulnerability management, incident management and response, secure development techniques and approaches, Cyber Security engineering and operations, and management and governance of Cyber Risk and Cyber Security. Having performed a similar role in a distributed organisation, you will have a strong information security background.

What you will do:

• Align to Precisely Information Security Management System across the Engage business unit that addresses the needs of Engage, staff, partners, customers, and other external stakeholders in line with relevant legislation and industry standards
• Maintain current SOC 1 & 2 Type II, HIPAA HITECH and ISO 27001 & 27701 certification for Engage software products.
• Maintain documentation and processes necessary to comply with contractual obligations and customer security requirements.
• Implement additional compliance in coordination with Precisely Info Sec Compliance as needed for each software product.
• Maintain robust and fit-for-purpose operational procedures.
• Ensure that the structures and reporting systems are in place to allow the Engage Information Security team to work with the Precisely CISO Office in maintaining the highest standards of quality, legal and regulatory compliance and corporate governance in all areas.
• Provide advice and direction to the Engage Product Management team, on how software products can comply with regulations.
• Propose changes to the Engage Information and Cyber Security systems, processes and procedures by continuously analysing and reviewing appropriate security technologies and practices as informed by Precisely standards.

• Ensure that information and Cyber Security risks to Engage are identified and managed appropriately.
• Use and improve Precisely measures and metrics to support the assessment, reporting and ongoing improvement of the Engage information security posture.
• Work closely with internal stakeholders to keep abreast of planned changes to technologies, working practices, and business activities that could have an impact on Engage’s Information Security or risk profile.
• Maintain the Precisely information assurance framework for Engage, enforcing compliance with policies in conjunction with internal audit.
• Align to Precisely standards and oversee Cloud Governance procedures for all infrastructure running in the cloud.
• Coordinate quarterly DAST scans, annual internal pen testing and annual third-party…