Cybersecurity Manager

Discovery Life Sciences (Discovery) is a leading provider of highly characterized human biospecimens and cellular starting materials to advance cell and gene therapy and precision medicine programs for cancer, infectious disease, and other complex conditions. We routinely manage hundreds of studies and expertly test thousands of biospecimens simultaneously. Leading biopharma, diagnostic and academic institutions trust us to quickly deliver high-quality biospecimens and reliable, reproducible biomarker data, so they can outpace their competition and push the leading edge of innovation using our Science at your Service TM business model.

Position Summary:

Discovery Life Sciences is seeking an experienced Cybersecurity Manager to join our Information Technology team as a hands-on individual contributor responsible for protecting the company's people, data, systems, and regulated operations. This role combines cybersecurity operations with governance, risk, and compliance (GRC) responsibilities, requiring both strategic thinking and technical execution.

The Cybersecurity Manager will play a key role in maintaining and enhancing the organization's security posture by leading incident response, vulnerability management, audit readiness, risk management, and compliance initiatives across global operations. This position serves as a trusted security partner to stakeholders across IT, Quality, Legal, Privacy, HR, Finance, and business functions, while helping scale a mature cybersecurity program that supports Discovery's continued growth.

A Day in the Life of a Cybersecurity Manager at Discovery Life Sciences:

• Monitor and investigate security alerts, coordinate incident response activities, and lead remediation efforts to minimize business risk.
• Partner with internal teams and external auditors to maintain compliance with SOC 2 Type II, ISO 27001, NIST, and regulatory requirements.
• Review vulnerability and penetration testing results, prioritize remediation activities, and track progress through resolution.
• Collaborate with Infrastructure, Cloud, Applications, Legal, Privacy, Quality, and business leaders to address emerging risks and strengthen security practices.

Must-Have Qualifications (Education, Skills, Experience):

• Must live near or be willing to relocate to Huntsville, AL
• Bachelor's degree in Computer Science, Information Security, Information Technology, or a related field; equivalent practical experience will also be considered.
• CISSP, CISA, CRISC, Security+, or a comparable cybersecurity certification preferred.
• Certifications are valued but are not a substitute for demonstrated hands-on experience.
• Five (5)+ years of progressive experience in cybersecurity, security operations, IT risk management, IT audit, or a comparable hands-on role.
• Deep expertise in either Security Operations or Governance, Risk, and Compliance (GRC), with working experience in the complementary discipline.
• Experience in life sciences, healthcare, biotechnology, financial services, or another regulated industry required
• Hands-on experience with several of the following:
  Microsoft Sentinel, Microsoft Defender, Microsoft Intune, Microsoft Purview, Tenable, firewalls, endpoint security, cloud security, identity and access management, KQL, or Power Shell.
• Practical experience investigating and responding to security incidents, coordinating remediation, and exercising sound judgment under pressure.
• Experience supporting or operating security controls aligned to SOC 2, ISO 27001, NIST, or similar frameworks; able to produce clear, defensible audit evidence.
• Experience with vulnerability management, third-party risk, policy and exception management, and risk tracking.
• Familiarity with 21 CFR Part 11, GxP, GDPR, data privacy, customer security reviews, or regulated validation practices.
• Experience with Microsoft Purview, DLP, data classification, DSPM, eDiscovery, Azure, AWS, or Microsoft 365 security capabilities.
• Demonstrated ability to automate repeatable security and compliance tasks through scripting or workflow tools.
• Strong written and verbal communication skills, with the ability to explain technical risk and recommended action to executive, audit, and non-technical audiences.

Key Responsibilities:

Security operations and incident response:

• Monitor, triage, investigate, and respond to security alerts and incidents, lead containment, recovery coordination, and post-incident reporting.
• Administer and tune security controls across firewalls, network security…