Senior Cybersecurity Program Manager

Cybersecurity Program Manager

Lead the development, creation, and documentation of comprehensive IT security policies, standards, and procedures from scratch. Collaborate with IT and Security teams to identify policy and procedure gaps and requirements. Write and maintain enterprise-wide security policies covering access control, data protection, incident response, and other critical areas. Ensure all policies and procedures align with regulatory requirements, compliance frameworks, and industry best practices. Review, update, and maintain existing policies and procedures to reflect organizational changes and emerging threats. Establish clear, enforceable standards that are communicated and understood across technical and non-technical teams. Document procedures with step-by-step guidelines for consistent implementation across departments. Conduct periodic audits of policy compliance and recommend updates based on audit findings and lessons learned. Facilitate policy review cycles and stakeholder approval processes.

Requirements include 10+ years of experience in cybersecurity, with at least 5 years in a program management or leadership role. Proven experience writing, developing, and maintaining IT security policies, standards, and procedures from scratch. Demonstrated ability to collaborate with IT and security teams to create comprehensive policy documentation. Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field. Deep knowledge of cybersecurity frameworks and standards (NIST CSF, ISO 27001, CIS, SOC 2, CMMC Controls). Experience with security governance and policy development. Expertise in risk management and compliance requirements across regulated industries. Strong understanding of security controls, threat modeling, and vulnerability management. Proficiency in program management methodologies (Agile, Waterfall). PMP or similar project management certification. Excellent project management skills with ability to manage multiple complex initiatives simultaneously.

Develop, establish, and maintain enterprise-wide cybersecurity programs aligned with business objectives and industry best practices. Create and execute multi-year cybersecurity roadmaps and strategic plans. Define program objectives, metrics, and key performance indicators (KPIs) to measure program effectiveness. Identify emerging cybersecurity threats and trends, and adjust program strategies accordingly. Manage program budgets and resource allocation to ensure optimal utilization. Lead and collaborate with IT, Security Operations, Risk Management, Compliance, and business unit leaders. Establish governance frameworks and decision-making processes for cybersecurity initiatives. Coordinate with external stakeholders, vendors, and third-party service providers. Facilitate communication between technical and non-technical teams to ensure program comprehension. Champion cybersecurity culture and awareness across the organization.

Ensure compliance with applicable regulatory requirements (CCPA, CPRA, SOC 2, CMMC etc.). Conduct and oversee risk assessments, vulnerability assessments, and penetration testing programs. Develop and maintain security policies, procedures, and standards. Monitor and report on security posture and compliance status to executive leadership and the Board. Lead incident response planning and coordination during security incidents. Oversee design, deployment, and optimization of security tools, technologies, and controls. Manage security architecture reviews and technology evaluations. Drive continuous improvement initiatives within the cybersecurity program. Document program processes, procedures, and operational guidelines. Ensure effective program documentation and knowledge management.

Provide executive leadership with regular updates on program status, risks, and achievements. Develop and present compliance metrics, dashboards, and reports to senior management. Communicate compliance requirements and implications to business stakeholders. Escalate critical issues and risks appropriately.