Information Security Manager

Job Description Position Summary

We are seeking a seasoned Information Security Manager/Engineer with a proven track record in similar SME settings to spearhead our Information Security (IS) and Information Assurance (IA) program. Reporting directly to the CIO, this role involves close collaboration with business leaders and the IT team to enhance our technical defenses, refine policies, elevate security awareness, address complex data privacy requirements, lead the documentation and testing of security controls and lastly take charge of incident response.

Vistage's IT team supports over 500 staff members and 1,000 consultants across 11 countries, and delivers extensive online services to a global community of over 45,000 members.

• Manage and operate security controls throughout the enterprise including providing oversight and verification of user and customer lifecycle and access controls
• Work with engineering, systems and product teams to manage the security implications and components of new projects
• Develop and maintain policies and plans including incident response, disaster preparedness, PCI, privacy and data protection compliance
• Prepare, deliver and verify company-wide infosec awareness training, including the specialist training of frontline and backoffice IT staff.
• Monitor key infosec platforms including endpoint antivirus, remote access, authentication, firewalls, intrusion detection – conduct investigations as needed
• Operate vulnerability and risk management tools, prioritizing remediation
• Orchestrate and verify periodic controls including annual risk assessments, quarterly configuration reviews etc
• Work with vendors to select and implement new infosec technologies, services and processes. Evaluate other vendor selections and development projects for infosec risk.
• Provide updated infosec risk assessments, proposing mitigation and new initiatives to address emerging threats, platform/vendor obsolescence etc

• We are seeking an enthusiastic infosec manager with a background that includes leading an infosec program, in an SME environment. Current or recent roles should include management of infosec, infrastructure or IT teams.
• Must have and be able to maintain current expertise is the infosec domain, and have experience with threats, risks and solutions typical for small to medium sized enterprises.
• Candidates must be confident in infosec best practices and operational risk management.
• Must be experienced with the M365 platform, including hands‑on tenant level administration, security and policy configuration
• Must have sufficient domain technical experience to perform risk assessments, operate vulnerability management and other security tools, guide incident response, act on emerging threats, lead technical implementation projects and work closely with engineering and infrastructure teams.
• Have experience operating a formal security program in a similar sized business, able to work at all levels of the organization and have experience verifying and demonstrating compliance, for example for internal or external auditors.
• Be an excellent communicator and collaborator, used to working with other engineering teams, support staff, business users and executives

• 3-5 years experience in an IT management role in a small or medium enterprise, with direct responsibility for information security, related risk management, operations and compliance.
• Current certifications in the infosec field, for example CISSP (preferred) or CISM
• Experience with managing enterprise grade security tools and infrastructure
• Experience developing and implementing infosec related policies, including communications, change management and related employee training.
• Experience of audit, assurance and compliance in a corporate environment, working with internal and external audit teams and authorities. Experience with control frameworks such as CIS, NIST or derivatives, COBIT or similar preferred.
• Experience administering M365 tenant and services; preferably past experience in a system administrator or system engineer role

$140,000 - $160,000 Salary + Corporate Bonus (salary based in San Diego, CA)

Hybrid in San Diego; 2 days onsite, 3 days offsite