Information Security Manager

Job Description

The Information Security Manager manages the implementation and ongoing operation of the New York Genome Center's ('NYGC') information security program to protect clinical, research, and business information. The role coordinates security operations, risk assessments, compliance activities, policy development, and incident response across enterprise systems, cloud services, and research environments.

Working with IT and organizational leadership, and external security providers, the Manager translates security priorities into actionable plans, coordinates implementation and reports material risks, program progress, and resource needs to leadership.

Key Responsibilities

Security Program Management and Governance

• Manage the security program's annual work plan and implementation of approved priorities.
• Author, maintain, and coordinate approval of information security policies, standards, and procedures.
• Coordinate policy implementation, employee communications, periodic reviews, and exception documentation.
• Coordinate external security service providers and monitor delivery against agreed service expectations.
• Develop security budget recommendations, evaluate proposed tools and services, and track approved expenditures.
• Maintain security metrics and report program performance, control gaps, and resource needs to leadership.

Risk Management and Compliance

• Conduct and coordinate security risk assessments; maintain the risk register and track remediation plans.
• Apply the NIST Cybersecurity Framework to assess security capabilities, identify gaps, and recommend prioritized improvements.
• Document risk treatment recommendations and route exceptions and risk acceptance decisions to authorized leadership.
• Support applicable HIPAA Security Rule compliance activities, including risk analysis, safeguard implementation, policy documentation, and corrective actions.
• Coordinate security audits, evidence collection, control assessments, and responses to findings.
• Conduct vendor security assessments, review contractual security requirements, and respond to external security questionnaires.
• Support security obligations associated with research agreements, grants, contracts, and data-use arrangements.

Security Operations and Technical Risk Management

• Coordinate daily security monitoring, alert escalation, vulnerability management, and remediation tracking.
• Coordinate with external monitoring providers; maintain investigation and escalation procedures.
• Coordinate vulnerability assessments and penetration testing, prioritize findings with IT and system owners, and track corrective actions to completion.
• Monitor the coverage and effectiveness of endpoint, identity, email, network, cloud, and logging controls.
• Coordinate security-tool deployment, configuration, integration, tuning, and maintenance with technical teams.
• Partner with IT and system owners on secure configurations, privileged access, access reviews, and account lifecycle controls.

Incident Response and Recovery

• Maintain and exercise the incident response plan and supporting operational playbooks.
• Coordinate security investigations, containment, recovery, and post-incident corrective actions, escalating significant incidents to leadership..
• Maintain incident documentation and communicate findings to designated stakeholders.
• Partner with IT and operational owners on backup security, recovery planning, and exercises.
• Participate in after-hours incident response under established coverage arrangements.

Research Data Protection and Security Awareness

• Partner with researchers, clinical teams, and IT to secure sensitive data access, storage, transfer, and collaboration.
• Review proposed systems and workflows and recommend practical security safeguards.
• Develop and deliver security awareness training, phishing education, and guidance for specialized teams.
• Communicate security requirements clearly and help stakeholders implement them.

Required Qualifications

• Bachelor's degree in information security, computer science, or a related field, or equivalent relevant experience.
• At least 5 years of progressively responsible information security experience, including at least 2 years managing security projects, operational functions, or program components.
• Demonstrated experience applying the NIST Cybersecurity Framework to assess controls, identify gaps, prioritize improvements, and track remediation.
• Demonstrated experience with security risk assessments, incident response, vulnerability management, and third-party security risk.
• Experience authoring and revising security policies, standards, and procedures and coordinating their review and implementation.
• Experience implementing, monitoring or coordinating security controls across identity systems, endpoints, networks, cloud services, and monitoring platforms.
• Experience coordinating technical teams and vendors and presenting actionable security recommendations to management.

Preferred Qualifications

• CISSP, CISM, or a comparable security certification.
• Experience in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.
• Experience supporting federally funded research or implementing contractual, sponsor, or data-use security requirements.
• Experience applying NIST SP 800-53 or SP 800-171 to applicable security obligations.
• Experience managing external security providers.

Competencies

• Technical and Professional Skills: Demonstrates strong judgment, integrity, discipline, and reliability; appropriately prioritizes work, manages expectations, and consistently delivers on commitments..
• Collaborative & Communicative: Builds strong relationships across functions; communicates clearly and thoughtfully; listens carefully; fosters collaboration and trust..
• Adaptable & Innovative: Embraces change, anticipates challenges, develops practical solutions, and continuously seeks opportunities to improve organizational effectiveness.
• Leader and Manager: Aligns people and priorities around institutional goals; inspires collaboration; drives execution; develops talent; and translates vision into action.

Work Location

This position will require to be on site at least 2 days a week at our downtown Manhattan location. Occasional evening and weekend work may be required.

Salary & Benefits

The pay range for this position is $130,000-150,000 per year; the base pay offered may vary depending on job-related knowledge, skills, and experience.

In addition, NYGC offers a full range of medical, financial, and other benefits as well as generous time off. This includes Medical/Dental/Vision for employees & dependent(s); Vacation, Holidays, Sick, and Other Leave, including a paid winter break; a 401(k) match; Life Insurance; Flexible Spending Accounts; employee Tuition Reimbursement; an Employee Assistance Program; and much more.