Information Security Program Manager

The Information Security Program Manager (ISPM) serves as a strategic security advisor and primary governance lead for assigned clients.

The ISPM is responsible for developing, managing, and maturing client information security programs with a strong emphasis on Cybersecurity Maturity Model Certification (CMMC), NIST compliance, risk management, governance, policy development, and assessment readiness.

This position works closely with clients, technical teams, Security Operations personnel, external assessors, and executive leadership to ensure security programs align with business objectives, compliance obligations, and industry best practices.

The ISPM serves as a trusted advisor to client leadership and is accountable for the successful execution of security governance activities, compliance initiatives, risk management processes, and security program outcomes.

Serve as the primary advisor and governance lead for assigned clients.

• Lead client governance meetings and security program reviews.
• Develop and manage client security roadmaps and strategic initiatives.
• Provide security guidance to executive leadership and key stakeholders.
• Track program goals, projects, milestones, and security initiatives.
• Coordinate activities between clients, technical teams, security operations, and third-party partners.
• Present security posture, compliance status, risks, and recommendations to client leadership.
• Drive continuous improvement of client security programs.

Lead compliance initiatives with a focus on CMMC readiness and regulatory alignment.

• Serve as a subject matter expert on CMMC, NIST 800-171, HIPAA, and related security frameworks.
• Conduct compliance assessments, gap analyses, and readiness reviews.
• Interpret security, regulatory, and contractual requirements.
• Develop remediation plans to address compliance gaps.
• Guide clients through CMMC assessment preparation and readiness activities.
• Coordinate evidence collection, assessment planning, and audit support.
• Stay current on evolving compliance requirements and industry best practices.
• Provide compliance recommendations and implementation guidance.

Lead risk management and security improvement initiatives.

• Conduct security risk assessments and program reviews.
• Maintain oversight of client risk registers and remediation activities.
• Identify, evaluate, and prioritize business, operational, and security risks.
• Develop risk treatment and mitigation recommendations.
• Facilitate risk review discussions and risk acceptance decisions.
• Provide strategic recommendations to improve security maturity and resilience.
• Support vulnerability, application, vendor, and operational risk review activities.

Ensure security programs are properly documented, maintained, and aligned with requirements.

• Develop and maintain:
  • System Security Plans (SSP)
  • Written Information Security Programs (WISP)
  • Plans of Action & Milestones (POA&M)
  • Policies, Procedures, and Standards
  • Governance and assessment documentation
• Align documentation with implemented controls and compliance requirements.
• Maintain traceability between requirements, risks, controls, findings, and remediation activities.
• Review and update documentation based on regulatory, business, and technology changes.
• Support standardization and continuous improvement of security program documentation.

Support and strengthen ongoing client security operations and preparedness.

• Lead security awareness and compliance training initiatives.
• Facilitate tabletop exercises and security program testing.
• Oversee incident response planning and program readiness.
• Participate in significant security incidents as an advisor and coordinator.
• Conduct post-incident reviews and lessons-learned activities.
• Ensure incidents, findings, and corrective actions are incorporated into risk management and governance processes.
• Support application security reviews, vendor risk…