Lead Cybersecurity Specialist

Job DescriptionJob DescriptionCentiMark Corporation is hiring a Lead Cybersecurity Specialist in our Canonsburg headquarters in SouthPointe! This is a full in-office role with an established company that isboth family-founded and 100% employee-owned through our Employee Stock Ownership Program (ESOP).The Lead Cybersecurity Specialist is an operational, hands-on position that will own, mature, and defend our enterprise cybersecurity environment. Reporting directly to the CIO, you will translate contractual and regulatory security requirements into day-to-day administrative policies and direct our external Managed Security Services Provider (MSSP).This role is responsible for maturing our current CIS Controls baseline toward NIST CSF, NIST SP 800-171, and customer-mandated CMMC requirements. You will also take active ownership of enterprise-grade Data Loss Prevention (DLP) across Google Workspace, SAP, and Salesforce, while establishing real-world security guardrails for our enterprise AI adoption (Google Gemini).Key ResponsibilitiesSecurity Maturity, Framework Alignment & Roadmapping: Execute and mature the multi-year IT Cybersecurity Roadmap under the direction of the CIOAdvance our defensive posture from our current CIS Critical Security Controls (v8) baseline to satisfy customer-driven NIST CSF, NIST SP 800-171, and CMMC Level 2 compliance requirementsTranslate contractual and regulatory security requirements into day-to-day administrative policies, identity controls, and operational runbooksMaintain an auditable repository of security policies, evidence artifacts, and compliance documentation Data Loss Prevention (DLP) & AI Security Governance: Design, implement, tune, and monitor enterprise DLP policies across core business platforms: Google Workspace (Drive, Gmail), Salesforce CRM, and SAP ERPClassify sensitive commercial, financial, and customer data; establish strict egress boundaries and access controls to prevent data exfiltrationBuild operational governance, prompt hygiene standards, and data perimeter rules for enterprise generative AI tooling (Google Gemini)Partner with sales operations and customer service leaders to ensure data protection controls support high-speed commercial workflows"Working Manager" Operations & MSSP Oversight: Direct our 24/7/365 external Managed Security Services Provider (MSSP / MDR), holding them accountable to SLAs, threat detection fidelity, and alert escalation protocolsDirectly manage, configure, and audit core security tools: Endpoint Detection and Response (EDR), Identity and Access Management (IAM/SSO/MFA), email hygiene filters, and vulnerability management scannersServe as the primary internal technical escalation point for security events, anomalous behavior investigations, and triage Cyber Assurance: Pen Tests & Incident Response: Scope, coordinate, and oversee annual third-party external/internal penetration tests; track vulnerability remediation through completion with infrastructure teamsDesign, coordinate, and lead annual tabletop exercises (TTX) for cybersecurity incidents, testing response readiness across IT, Operations, Legal, and Executive leadershipMaintain and update the Incident Response Plan (IRP), Disaster Recovery (DR) alignments, and business continuity runbooks Customer Trust & Commercial Enablement: Serve as the primary security subject matter expert reviewing customer security questionnaires, RFPs, and Master Services Agreement (MSA) security addendumsParticipate in customer security audits and vendor risk management reviews to accelerate enterprise sales cyclesDesign and execute role-tailored Security Awareness Training programs and ongoing phishing simulations Candidate Qualifications & RequirementsExperience & Mindset: 6–8+ years of progressive hands-on information security experience, including at least 2+ years in a technical lead, supervisory, or management roleTrue Working Manager Philosophy: Demonstrated track record of rolling up your sleeves to write policies, review logs, and configure security tools while also coordinating vendor contractsFramework Translation: Practical experience implementing or maturing security frameworks from CIS Controls to NIST CSF / SP 800-171 or preparing an environment for CMMCMSSP Leadership: Experience holding third-party managed detection and SOC providers accountable for alert triage, false-positive reduction, and threat huntingFull-Time On-Site Dedication: Ability to work on-site five days a week at our Canonsburg, PA headquarters, driving hands-on collaboration with executive and cross-functional teamsTechnical Proficiencies: Core Systems: Hands-on administrative and security configuration experience within Google Workspace Enterprise, Salesforce, and SAPData Protection: Direct experience engineering, deploying, and tuning Data Loss Prevention (DLP) and data classification solutionsAI Readiness: Solid understanding of generative AI risks (data leakage, prompt security, access controls) and administrative boundaries in Google Gemini or equivalent toolsThreat & Incident Management: Practical experience coordinating penetration test remediation, conducting tabletop exercises, and triaging security incidentsCertifications & Education: