Cyber Security Program Manager

Primary Purpose of Job: The Cyber Security Program Manager is responsible for leading and operationalizing QuikTrip's Enterprise Cyber Security Program, including the development, implementation, and continuous improvement of security strategy, practices, and standards across the corporation and its subsidiaries. This role serves as the day-to-day manager of enterprise cybersecurity initiatives-coordinating governance, driving security execution, and ensuring alignment with organizational objectives. In addition to core cybersecurity program responsibilities, this position serves as the primary cybersecurity leader for QuikTrip's subsidiaries-ensuring their security operations, controls, and governance align with enterprise standards. The role also supports broader regulatory and compliance initiatives such as Payment Card Industry (PCI), contributes to the development and maintenance of the Enterprise Privacy Program, and operates as the HIPAA Security Officer to uphold all security requirements related to protected health information. Major functions for this position: Assist in developing and overseeing QuikTrip's Enterprise Cyber Security Strategy, practices, and programs. Assist in planning and implementing security for all computing hardware and software systems. (60%) Assist and advise user departments in appropriate security procedures. Protect the corporate computing infrastructure from unauthorized access. Protect the company network from attacks. Protect the confidentiality of company data and employee information. Oversee the development and maintenance of Information Technology security and compliance standards. Set policy on introduction of third-party software to the network, implement end point protection software, and monitor compliance. Assist in the maintenance, development, and operation of QuikTrip's Privacy program. (5%) Governance - Ensure policies, standards and procedures are kept up to date, monitor adherence to program, establish and maintain Privacy Committee involving business leaders from across the enterprise. Ensure Privacy Impact Assessments are continually run across projects or efforts around privacy, continual development of processes related to PIA's, and perform regular compliance assessments to validate policies are affecting and being adhered to. Ensure Continuous Compliance Monitoring across the enterprise to make sure the Privacy program is operating effectively. This will include audits of process, third party, controls, reporting, and incident response measures. Ensure the creation of a Personal Data Inventory, including usage, processing activities, data retention, and anonymization. Ensure Awareness, Training, and other communications related to the Privacy program are in place and effective. Liaise and communicate effectively with external entities, such as supervisory and regulatory authorities. Ensure Cyber Security program follows relevant industry and governmental standards, including but not limited to the Payment Card Industry Data Security Standard and HIPAA Standard. (10%) Fill the role of HIPAA Security Officer (HSO) by managing information security policies, procedures, and technical systems to maintain the confidentiality, integrity, and availability of healthcare information systems, conducting investigations, and maintaining records. Keep apprised of changes to the standard. Evaluate new systems for impact. Conduct annual PCI audit and submit result to QuikTrip's acquirer. Directing the work effort and providing information to internal and external resources as required. (10%) Conduct an annual risk assessment of QuikTrip's systems, evaluating risk of loss versus operating cost. Present results to Senior Management for review and acceptance. Develop and produce metrics on IT Security for Board of Directors, IT Leadership, and general QT employees. On request of management, present reports concerning security-related activity of specific employees or vendors. Interface with QT internal auditors, financial auditors, PCI auditors, and any other external auditors as required. Provide any requested information and arrange meetings with QT personnel. Provide responses and compensating controls to audit comments. Provide security support to IT department and the Company at large. (5%) Lead troubleshooting efforts to resolve security issues and problems for QT systems. Work with technology groups to provide general security direction, guidelines, and controls. Ensure the technical design of all major systems have the appropriate levels of technology security as well as making sure all new systems adhere to QuikTrip security standards. Conduct risk assessments of new technology and custom applications. (5%) Contribute to IT Strategic Planning and budgeting process, as well as day-to-day security planning, by analyzing future security needs, make recommendations on computer hardware, software, and processes. (5%) Position in Organization:

• Reports to: Director of Cyber Security (CISO)
• Directly supervises: N/A
• Indirectly supervises: CSOC, GRC, Cyber Security Architect, Cyber Security Engineers, and all Cyber Security related roles.

Relationships:

• Inside the Company: All Information Technology personnel and high percentage of other department personnel. High level of contact and interaction with the General Counsel.
• Outside the Company: Hardware/software vendors, professional service providers personnel in other company data processing installations. External auditors and assessment firms. Professional security and disaster recovery organizations and user groups.

Position Specifications: The required specifications (education, experience, and skills) are those that the employee must have to hold the position. Applicants applying for this position must possess the required specifications to be considered for the job. The desired specifications are those that are not required for the employee to hold the position, but the employee should try to obtain the desired education, experience, and/or skills to be effective and successful in the position. Required education: Bachelor's Degree, preferably in MIS or Computer Science or equivalent work experience. Desired education: Certification as an Information Systems Security Professional. (CISM, CISA, CISSP, SANS, or equivalent) Required experience: Extensive experience in cybersecurity program management and operations. 8+ years of cybersecurity practices and technologies spanning risk management, governance, architecture, cloud security, threat detection, incident response, and vulnerability management. Intimately familiar with cyber security frameworks like NIST and CIS. Desired experience: Disaster Recovery planning, CSIRT, regulatory compliance (PCI, HIPAA, Privacy), ITIL Required skills: Solid grasp of the issues associated with standards, compliance, security, and disaster recovery including the costs, benefits, and risks to the company. Strong oral and written communications skills. Project leadership skills. Desired skills: AD and MS servers, AS400, security and audit tools, Network and Telecommunications experience. Additional criteria: Must be able to work under pressure and provide guidance to Information Technology users during crisis modes. On call 24 by 7. This position requires the employee to be available by phone and/or email and/or have accessibility to calendar, contacts, and data while out of the office. Starting Salary: $146,000-$182,520 Benefits: Employee Benefits - QuikTrip #LI-MI1 QuikTrip Corporation