About the role
About the RoleWe are looking for an experienced Information Security Manager to lead and oversee the organization's information security program.The individual will be responsible for establishing security policies and standards, ensuring security practices are implemented across all departments, conducting security audits, identifying risks, managing security incidents, and driving continuous improvement of the organization's security posture.This role requires a combination of strong technical cybersecurity knowledge, security governance expertise, risk management experience, and the ability to work independently with engineering, DevOps, IT, QA, and business teams.The successful candidate will serve as the primary point of contact for all information security matters across the organization.Key Responsibilities
- Own and manage the organization's information security program, policies, standards, and procedures.
- Conduct periodic security audits and assessments across Engineering, DevOps, IT, QA, and other departments.
- Identify security vulnerabilities, compliance gaps, operational risks, and recommend corrective actions.
- Establish and maintain security risk registers, remediation plans, and compliance documentation.
- Oversee application, infrastructure, cloud, database, and network security practices.
- Ensure secure software development practices and security controls are implemented across engineering teams.
- Manage security incidents, investigations, root-cause analysis, incident reporting, and corrective actions.
- Establish security monitoring, vulnerability management, access control, and security review processes.
- Ensure compliance with applicable security standards and regulatory requirements, including HIPAA, SOC 2, ISO 27001, and NIST, as applicable.
- Prepare security assessment reports, risk summaries, and recommendations for executive leadership.
- Drive security awareness and training programs across the organization.
- Monitor remediation activities and ensure identified security issues are resolved within agreed timelines.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 8–12 years of experience in information security, cybersecurity, or IT security.
- At least 3 years of experience in security management, governance, risk management, or a senior security leadership role.
- Strong understanding of security governance, risk assessments, vulnerability management, and security auditing.
- Practical knowledge of application security, OWASP Top 10, secure coding practices, API security, and authentication mechanisms.
- Experience with cloud security (AWS/Azure), infrastructure security, database security, network security, and access management.
- Experience managing security incidents, investigations, and remediation activities.
- Demonstrated experience developing and implementing security policies, procedures, and organizational security controls.
- Strong communication, documentation, analytical, and leadership skills.
- CISSP, CISM, CISA, CCSP, or ISO 27001 Lead Auditor / Lead Implementer certification.
- Experience in healthcare technology or organizations handling sensitive patient information.
- Practical knowledge of HIPAA Security Rule, SOC 2, and ISO 27001 requirements.
- Experience with AWS cloud security and SaaS application security.
- Experience conducting internal security audits and coordinating external security assessments.
- A self-driven professional capable of independently managing the organization's security program.
- Someone who can technically evaluate security implementations rather than relying solely on reports from other teams.
- Ability to identify security gaps, challenge existing practices, and drive corrective actions.
- Strong ownership and accountability for organization-wide security.
- Ability to communicate technical risks and provide clear, actionable recommendations to management.