Enterprise Cyber Security Manager

The Enterprise Cybersecurity Manager will interface with peers in the Information Technology department and with business unit leaders to share the agency security vision and ensure compliance with existing and new security requirements as they relate to the network, servers, cloud, applications, and other infrastructure activities.

• Lead the selection, deployment, and management of security solutions.
• Oversee vulnerability assessments, penetration testing, and security audits.
• Manage incident response and recovery efforts, including post‑incident reviews.
• Provide executive‑level reporting on security posture, risks, and incidents.
• Partner with business leaders to embed security into operations and projects.
• Ensure security requirements are embedded in procurement and vendor contracts.
• Drive continuous improvement of the security program through maturity assessments and roadmaps.

• Develop, maintain, and communicate the agency’s information security strategy and roadmap. (E)
• Provide regular briefings to the CIO, executive leadership, and Board/Audit Committee on security posture, risks, and incidents. (E)
• Integrate security risk management into the agency’s enterprise risk management (ERM) framework. (E)
• Develop and maintain security policies, standards, baselines, guidelines, and procedures. (E)

• Conduct regular security program maturity assessments and develop multi‑year improvement roadmaps. (E)
• Champion adoption of industry best practices and frameworks (e.g., NIST, ISO 27001, CIS Controls). (E)
• Define and track security KPIs and metrics to measure program effectiveness.

• Create and maintain the agency’s security architecture design. (E)
• Oversee security for on‑premises, cloud, and hybrid environments. (E)
• Evaluate and mitigate risks associated with emerging technologies (AI, IoT, OT). (E)
• Oversee Identity & Access Management (IAM) strategy, including MFA and privileged access controls.

• Lead the incident response process, including investigation, containment, eradication, recovery, and post‑incident review. (E)
• Conduct regular tabletop exercises and simulations for incident preparedness. (E)
• Collaborate with legal counsel and law enforcement when necessary.

• Evaluate and manage third‑party/vendor security risks. (E)
• Lead security due diligence for strategic partners and service providers. (E)
• Negotiate and enforce security requirements in contracts and SLAs.

• Build, mentor, and retain a high‑performing security team. (E)
• Foster a culture where security is viewed as a business enabler. (E)
• Launch and maintain a Security Champions program to embed security awareness across departments.

• Maintain up‑to‑date knowledge of the threat landscape, emerging technologies, and evolving regulatory requirements. (E)
• Recommend and implement security solutions or enhancements to improve overall security posture. (E)
• Oversee deployment, integration, and configuration of new security solutions in accordance with best practices and agency standards. (E)

• Ensure the confidentiality, integrity, and availability (CIA) of agency data and systems. (E)
• Monitor security events and coordinate with SOC or monitoring teams to respond to threats.
• Oversee compliance with relevant laws, regulations, and frameworks (e.g., NIST, ISO 27001, FedRAMP).

• Strong leadership and influencing skills.
• Exceptional analytical and problem‑solving abilities.
• Ability to prioritize and execute in high‑pressure environments.
• Excellent communication skills, with the ability to present complex topics to non‑technical audiences.
• High integrity and commitment to ethical practices.
• Collaborative mindset with the ability to build trust across the organization.

40‑hour on‑site work week with on‑call availability; sitting for extended periods of time; sufficient dexterity of hands and fingers to efficiently operate a computer keyboard, mouse and other computer components.

• Bachel…