UniFirst Hiring for Information Security Manager Job at Wilmington, MA Full Time

The Information Security Manager is responsible for establishing and maintaining a corporate wide information security management program to ensure that information assets are adequately protected. This position is responsible for identifying, evaluating, and reporting on information security risks in a manner that meets compliance and regulatory requirements, and aligns with and supports the risk posture of the enterprise.

The ISM serves as the process owner of all assurance activities related to the availability, integrity and confidentiality of customer, business partner, employee, and business information in compliance with the organization’s information security policies. A key element of the ISM’s role is working with executive management to determine acceptable levels of risk for the organization. The ISM must be highly knowledgeable about the business environment and ensure that information systems are maintained in a fully functional, secure mode.

The ISM’s job is composed of a variety of activities, including very tactical, operational, and strategic activities in support of the ISM’s program initiatives, such as:

• Strategic support
• Security liaison
• Architecture/engineering support
• Operational support

Responsibilities:

• Develop, implement, and monitor a strategic, comprehensive enterprise information security and IT risk management program to ensure that the integrity, confidentiality, and availability of information is owned, controlled, or processed by the organization.
• Manage the enterprise’s information security organization, consisting of direct reports and indirect reports (such as individuals in business continuity and IT operations). This includes hiring, training, staff development, performance management and annual performance reviews.
• Facilitate information security governance through the implementation of a hierarchical governance program, including the formation of an information security steering committee or advisory board.
• Develop, maintain, and publish up-to-date information security policies, standards, and guidelines. Oversee the approval, training, and dissemination of security policies and practices.
• Create, communicate, and implement a risk-based process for vendor risk management, including the assessment and treatment for risks that may result from partners, consultants, and other service providers.
• Develop and manage information security budgets and monitor them for variances.
• Create and manage information security and risk management awareness training programs for all employees, contractors, and approved system users.
• Work directly with the business units to facilitate IT risk assessment and risk management processes, and work with stakeholders throughout the enterprise on identifying acceptable levels of residual risk.
• Provide regular reporting on the current status of the information security program to enterprise risk teams, senior business leaders and the board of directors as part of a strategic enterprise risk management program.
• Provide strategic risk guidance for IT projects, including the evaluation and recommendation of technical controls.
• Ensure that security programs comply with relevant laws, regulations, and policies to minimize or eliminate risk and audit findings. (PCI, SOX compliance)
• Manage security incidents and events to protect corporate IT assets, including intellectual property, regulated data and the company’s reputation.
• Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action.
• Develop and oversee effective disaster recovery policies and standards to align with enterprise business continuity management program goals. Coordinate the development of implementation plans and procedures to ensure that business-critical services are recovered in the event of a security event.
• Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security.
• Understand and interact with related disciplines through committees to ensure the consistent application of policies and standards across all technology projects, systems, and services, including, but not limited to, privacy, risk management, compliance, and business continuity management.
• Liaise among the information security team and corporate compliance, audit, legal and HR management teams as required.
• Consult with IT and security staff to ensure that security is factored into the evaluation, selection, installation and configuration of hardware, applications, and software.
• Research, evaluate, design, test, recommend or plan the implementation of new or updated information security hardware or software, and analyze its impact on the existing environment; provide technical and managerial expertise for the administration of security tools.
• Manage and coordinate operational components of incident management, including detection, response, and reporting.
• Manage the day-to-day activities of threat and vulnerability management, identify risk tolerances, recommend treatment plans, and communicate information about residual risk.

Qualifications

Requirements:

• A bachelor’s degree in information systems or equivalent work experience; an M.B.A. or M.S. in information security is preferred.
• Certifications: CISSP, CISM, CISA, GIAC, etc.
• A minimum of 10 years of IT experience, with 5 years in an information security role and at least 2 years in a supervisory capacity.
• Experience with common information security management frameworks, such as National Institute of Standards & Technology (NIST), Center for Internet Security Critical Security Controls (CIS), Control Objectives for Information and Related Technology (COBIT)
• Exhibit excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
  Project management skills: financial/budget management, scheduling, and resource management.
• Ability to lead and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals.
• A strong understanding of the business impact of security tools, technologies, and policies.
• Strong leadership abilities, with the capability to develop and guide information security team members and IT operations personnel, and work with minimal supervision.
• Excellent verbal, written and interpersonal communication skills, including the ability to communicate effectively with the IT organization, project and application development teams, management, and business personnel; in-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls; an excellent understanding of information security concepts, protocols, industry best practices and strategies.
• Experience working with legal, audit and compliance staff.
• Experience developing and maintaining policies, procedures, standards, and guidelines.

UniFirst offers a Fleet of Benefits, 50+ to be exact!

• 401K with Company Match
• Profit Sharing
• Health Insurance
• Employee Assistance Program
• Life Insurance
• Supplemental Life Insurance
• Long Term Disability
• Vacation
• Sick Time
• Paid Holidays
• Direct Payroll Deposit
• Tuition Reimbursement
• 30% Employee Discount
• Employee Referral Program

UniFirst is an equal opportunity employer. We do not discriminate in hiring or employment against any individual on the basis of race, color, gender, national origin, ancestry, religion, physical or mental disability, age, veteran status, sexual orientation, gender identity or expression, marital status, pregnancy, citizenship, or any other factor protected by anti-discrimination laws

UniFirst is an equal employment/affirmative action employer. If you need accommodation for any part of the application process because of a medical condition or disability, please send an e-mail to [email protected] or call (978) 658-8888 to let us know the nature of your request.

UniFirst Recruiters and/or representatives will not ask job seekers to provide personal financial information when submitting a job application. Please be vigilant as such requests for information may be fraudulent.