Information Security Manager

Precisely is proud to be an Equal Opportunity and Affirmative Action employer. We celebrate everything that makes an applicant unique. We will consider all qualified applicants without regard to race, color, creed, religion, sex (including pregnancy), age, sexual orientation, gender identity, gender expression, national origin, ancestry, physical or mental disability, marital status, genetic information, citizenship status, or veterans' status or other applicable legally protected characteristics.

We are committed to providing reasonable accommodations for candidates with disabilities in our recruiting process.

Position Title: Information Security Manager

Engage is a business unit that builds software products that process personal data, and we are looking for an Information Security Manager who can align product design with security and privacy requirements. You will lead a team that manages technical and process security controls, and you will work within our broader security and governance model under the guidance of our security and privacy leaders.

You will help keep our controls current, support audits, and ensure that product and services teams follow our security policies. You will also partner with compliance groups and external auditors to maintain certifications and meet regulatory needs. You will communicate risks to our security risk boards and leadership teams. You will succeed in this role by understanding our technology, staying current with security standards, and bringing strong experience from similar roles in distributed organizations.

This role will report to Senior Director of Software Development.

• Align to Precisely Information Security Management System across the Engage business unit that addresses the needs of Engage, staff, partners, customers, and other external stakeholders inline with relevant legislation and industry standards
• Maintain current SOC1 & 2 Type II, HIPAA HITEC and ISO 27001 & 27701 certification for Engage software products
• Maintain documentation and processes necessary to comply with contractual obligations, customer security requirements and internal requirements
• Propose changes to the Engage Information and Cyber Security systems, processes and procedures by continuously analysing and reviewing appropriate security technologies and practices as informed by Precisely standards
• Ensure that information and Cyber Security risks to Engage are identified and managed appropriately. Communicate security risks to Precisely Info Sec Risk Board and senior leadership
• Coordinate quarterly DAST scans, annual internal penetration testing and annual third-party penetration testing across all Engage products
• Maintain accurate security scorecards across all products. Work with product teams to prioritise work to improve security score
• Coordinate annual legal review of privacy across Engage products
• Assist investigations into information security breaches under Precisely Incident Response process with Precisely Cyber Security Operations Center ensuring root-causes of such breaches are understood and addressed
• Assist as SME in responding to information security questionnaires during RFP process

Experience:

• Management of an Information Security Management System in a complex IT organisation encompassing service delivery, application development and IT infrastructure
• Completion of Information Security questionnaires as part of RFP responses
• Line management of team members

Knowledge:

• An excellent understanding of best practice within Information Security and risk management including standards such as ISO 27001
• A strong understanding of one or more areas or legislation and regulations that impact information Security e.g. GDPR, HIPAA, PCI DSS, CCPA
• An understanding of current and emerging threats and countermeasures and the product challenges to addressing these threats
• An understanding of Application Security threats and countermeasures
• A good practical knowledge of security technologies and wider business solutions including Dev Ops, Identity and Access Management, penetration testing tools, remote working and cloud technologies

Skills:

• The ability to work within a compliance or regulatory framework and to evidence continuous improvement
• Excellent communication skills, both written and verbal. Ability to present complex or highly technical issues in simple and easy-to-understand formats
• An ability to think and plan strategically and systematically while recognising the need to deliver to the business requirements
• The ability to be pragmatic while balancing the needs of the business against security
• The ability to cut through organisational and political barriers to achieve the overall goal

Qualifications:

• An appropriate degree, equivalent qualification or experience

Preferred requirements:

• One or more of the following qualifications are highly desirable
• Certified Information Security Manager (CISM)
• Certified Information Systems Security Professional (CISSP)
• Certified…