Position SummaryThe Manager, Cyber Security, Risk & Compliance leads the company's cyber security governance, information technology risk management, privacy assurance, and compliance coordination activities. This role serves as the primary point of contact for cyber threats and response coordination and works across Technology, Legal, Finance, Internal Audit, Operations, business teams, and third-party service providers to implement practical controls that protect company systems, data, customers, and operations.
The position combines governance and risk leadership with hands-on coordination of security testing, awareness, vulnerability management, PCI compliance, Data Protection Impact Assessments, incident response, and remediation tracking.
Key ResponsibilitiesIT Risk Management and Controls- Lead IT risk assessments for applications, infrastructure, projects, business processes, acquisitions, and third-party services.
- Maintain an IT and cyber security risk register, including risk owners, treatment plans, target dates, residual risk, and approved risk acceptances.
- Design, document, implement, and test preventive, detective, and corrective controls.
- Advise project teams and business owners on proportionate risk treatment and control requirements.
- Track remediation commitments and escalate overdue or material risks to leadership.
Cyber Security Governance and Operations- Develop and maintain cyber security policies, standards, procedures, control baselines, and incident response playbooks.
- Act as the primary company focal point for cyber threats, suspected compromises, security incidents, and response coordination.
- Coordinate triage, containment, investigation, recovery, communications, and lessons learned with internal teams and service providers.
- Monitor relevant threat intelligence, vulnerabilities, and emerging risks and translate them into business actions.
- Coordinate routine security testing, including phishing simulations, external vulnerability scans, penetration tests, and control validation.
- Oversee remediation of vulnerabilities and security findings through closure.
PCI Compliance and Assurance- Coordinate Payment Card Industry Data Security Standard compliance activities and serve as the central contact for assessors and internal stakeholders.
- Maintain the PCI compliance calendar, scope, evidence requests, responsibility assignments, and remediation plans.
- Coordinate external scans, testing, attestations, and audit evidence collection.
- Support internal and external audits and track findings and corrective actions to closure.
Data Protection and Privacy Risk- Coordinate Data Protection Impact Assessments for new or materially changed systems, processes, integrations, vendors, analytics, and artificial intelligence use cases.
- Work with Legal, Privacy, Architecture, Procurement, business owners, and technology teams to identify privacy risks and define controls.
- Maintain assessment records, data-flow documentation, approvals, risk decisions, and mitigation actions.
- Support privacy incident response and other data-protection assurance activities.
Security Awareness and Culture- Own the cyber security awareness and training program for employees and contractors.
- Plan and conduct phishing simulations and targeted education for higher-risk groups.
- Develop practical communications on current threats, secure behaviors, and employee responsibilities.
- Measure completion, simulation outcomes, repeat-risk patterns, and improvement actions.
Third-Party and Project Security- Perform or coordinate security, privacy, and technology risk reviews of vendors and service providers.
- Define security and data-protection requirements for procurement, contracts, onboarding, and ongoing monitoring.
- Embed security and privacy requirements into project delivery and technology change processes.
- Partner with vendors and managed security providers to validate performance and resolve control gaps.
Reporting and Stakeholder Management- Provide concise risk, compliance, vulnerability, incident, and training updates to IT and business leadership.
- Develop meaningful key risk indicators and key performance indicators for the cyber security and risk program.
- Translate technical issues into clear business impacts, options, decisions, and accountabilities.
- Build effective working relationships with business leaders, auditors, legal counsel, assessors, vendors, and technical teams.
Required Qualifications- Bachelor's degree in Information Security, Information Technology, Computer Science, Risk Management, or a related discipline, or equivalent relevant experience.
- Five to seven years of progressive experience in cyber security, information security, IT risk, governance, compliance, privacy, or technology assurance.
- Practical experience conducting IT risk assessments and designing, implementing, or testing controls.
- Working knowledge of PCI DSS, privacy impact assessments, vulnerability management, security awareness, and incident response.
- Experience coordinating audits, assessors, evidence collection, remediation plans, and cross-functional stakeholders.
- Ability to communicate technical risk in clear business language and influence action without relying on direct authority.
- Strong organization, judgment, documentation, facilitation, and follow-through skills.
Preferred Qualifications- Experience in retail, convenience, fuel, payments, or another distributed operating environment.
- Familiarity with recognized frameworks such as NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27001, or COBIT.
- Experience working with managed security service providers, external assessors, legal counsel, and cyber insurance providers.
- One or more relevant certifications, such as CISM, CRISC, CISSP, Security+, PCI ISA, ISO 27001, CIPP, or CIPM.
Core Competencies- Risk-based decision-making and sound professional judgment.
- Incident leadership and calm coordination under pressure.
- Business-oriented communication and executive reporting.
- Control design, assurance, and continuous improvement.
- Cross-functional collaboration and stakeholder influence.
- High integrity, discretion, accountability, and attention to detail.
Measures of Success- Risk assessments and DPIAs are completed on time and produce clear, actionable mitigation plans.
- PCI and audit activities are coordinated effectively, with evidence and remediation delivered by agreed dates.
- Critical vulnerabilities and control deficiencies are assigned, tracked, and resolved within established expectations.
- Cyber incidents are escalated and coordinated promptly, with documented lessons learned and follow-up actions.
- Security awareness participation and employee resilience improve over time.
- Leadership receives concise, decision-oriented reporting on material cyber security and technology risks.
Role Scope NoteThis position is designed as a combined cyber security, IT risk, privacy assurance, and compliance role. It provides program leadership and response coordination while partnering with infrastructure teams, application teams, business owners, Legal, Privacy, Internal Audit, external assessors, and specialized security service providers for deeper technical execution where required.
