Information Security Program Manager

The Information Security Program Manager (ISPM) serves as a strategic security advisor and primary governance lead for assigned clients. The ISPM is responsible for developing, managing, and maturing client information security programs with a strong emphasis on Cybersecurity Maturity Model Certification (CMMC), NIST compliance, risk management, governance, policy development, and assessment readiness. This position works closely with clients, technical teams, Security Operations personnel, external assessors, and executive leadership to ensure security programs align with business objectives, compliance obligations, and industry best practices. The ISPM serves as a trusted advisor to client leadership and is accountable for the successful execution of security governance activities, compliance initiatives, risk management processes, and security program outcomes. Serve as the primary advisor and governance lead for assigned clients. Develop and manage client security roadmaps and strategic initiatives. Track program goals, projects, milestones, and security initiatives. Coordinate activities between clients, technical teams, security operations, and third-party partners. Present security posture, compliance status, risks, and recommendations to client leadership. CMMC, Compliance & Assessment Management Lead compliance initiatives with a focus on CMMC readiness and regulatory alignment. Serve as a subject matter expert on CMMC, NIST 800-171, HIPAA, and related security frameworks. Conduct compliance assessments, gap analyses, and readiness reviews. Interpret security, regulatory, and contractual requirements. Coordinate evidence collection, assessment planning, and audit support. Provide compliance recommendations and implementation guidance. Risk Management & Security Advisory Lead risk management and security improvement initiatives. Conduct security risk assessments and program reviews. Maintain oversight of client risk registers and remediation activities. Identify, evaluate, and prioritize business, operational, and security risks. Develop risk treatment and mitigation recommendations. Facilitate risk review discussions and risk acceptance decisions. Support vulnerability, application, vendor, and operational risk review activities. Security Program Documentation & Control Management Ensure security programs are properly documented, maintained, and aligned with requirements. Written Information Security Programs (WISP) Policies, Procedures, and Standards Maintain traceability between requirements, risks, controls, findings, and remediation activities. Review and update documentation based on regulatory, business, and technology changes. Security Operations Support, Training & Incident Management Support and strengthen ongoing client security operations and preparedness. Lead security awareness and compliance training initiatives. Facilitate tabletop exercises and security program testing. Oversee incident response planning and program readiness. Ensure incidents, findings, and corrective actions are incorporated into risk management and governance processes. Support application security reviews, vendor risk reviews, and continuous monitoring initiatives. Experience in consulting or managed services environments. Creative problem-solving skills with the ability to take multiple components and pull them together into recommendations Strong organization and project management skills Business acumen- understanding business process, data flows, and system application use in a variety of business settings Technical aptitude- the ability to understand technical concepts, tools, and the IT landscape Life-long learner with a growth mindset that enjoys the pursuit of knowledge and is eager to stay updated in security policies and skill Prolonged periods of sitting at a desk and working on a computer. Travel between offices and to client sites Mainstay Technologies- IT you trust from a team you enjoy. Mainstay Technologies provides a full IT and Information Security department to small and medium size businesses in the northern New England area. As a company in the Best Companies to Work For Hall of Fame, we believe in using the power of technology and of business to help people flourish. This translates to a culture of caring, high-ownership teammates who work hard, enjoy each other immensely, and turn off the work at the end of the workday, to focus on what matters more than work. In addition to being a Best Company to Work For, we have also been recognized for Coolest Companies for Young Professionals, “Best of Business” for Managed IT Services, and the Torch Award for Marketplace Ethics. 500 | 5000 List for fastest growing small businesses 5 times. This is a full time, salaried position with a full benefits package, including:

• A flexible and fun work environment with events, lunch+ learns, ping pong, snacks, games, and books
• Health, Dental, and Vision Insurance
• Disability Insurance
• Group and Supplemental Life Insurance
• Training program (including paid certifications, tuition reimbursement, and bonuses on achieving certs)
• We offer strong flexibility to work remotely, while also recognizing the importance of face-to-face connection through team meetings, all-staff gatherings, and in-person client meetings.

We maintain a beautiful office in Manchester, NH, as well as a satellite office in Laconia, and we encourage each team member to choose the mix of home and in-office work that best supports their wellbeing and effectiveness. While coming into the office weekly is encouraged, it is not required. Application We utilize an Applicant Tracking System for our applications.