Senior Manager Information Security (Compliance) Remote From Anywhere In CO

Salary: $134,000.00 - $144,000.00 Annually
Location : Statewide, CO
Job Type: Full Time
Job Number: EGB93675
Department: Governor's Office of Information Technology
Opening Date: 11/02/2026
Closing Date: 11/17/2026 11:59 PM Mountain
FLSA: Determined by Position
Primary Physical Work Address: (Remote From Anywhere In CO)
FLSA Status: Exempt; position is not eligible for overtime compensation.
Department Contact Information:
Type of Announcement: This announcement is not governed by the selection processes of the classified personnel system. Applications will be considered from residents and non-residents of Colorado.
How To Apply: Please submit an online application for this position at https://www.governmentjobs.com/careers/colorado. Reach out to the Department Contact to apply using a paper application, including any supplemental questions. Failure to submit a complete and timely application may result in the rejection of your application. Applicants are responsible for ensuring that application materials are received by the appropriate Human Resources office before the closing date and time listed.

Description of Job
IMPORTANT NOTE: Please review your application to ensure completion. For the most equitable applicant experience, OIT's hiring team considers only the contents of the Work Experience section of your application to review your minimum qualifications. Though we do ask that a resume and cover letter are included in your application, please refrain from entering "See Resume" in the Work History section as valuable experience may be missed during the application review process.
Join the Information Security Office as our Senior Compliance Manager and empower a team dedicated to protecting Colorado's public services and data. In this role, you will lead the daily operations and ongoing development of our compliance program within the Information Security Office. Reporting to the leader responsible for Compliance and Risk, you will translate strategic priorities into practical roadmaps, repeatable audit processes, and measurable enhancements that safeguard state public services and constituent information.

As a people-centered leader, you will empower staff through clear expectations, regular coaching, balanced workloads, and fair accountability, ensuring processes remain resilient through staffing and leadership transitions. Working independently within delegated authority and collaborating closely with Risk Management, Directors of Technology, control owners, IT teams, and legal partners, you will direct compliance assessments, audit readiness, evidence management, management-response preparation, corrective-action tracking, and executive reporting across frameworks including the NIST Cybersecurity Framework, CJIS Security Policy, HIPAA, and IRS Publication 1075.
Essential Functions:

• Establish dependable one-on-one meetings, team priorities, and feedback. Assess strengths and development needs using work evidence and employee input. Provide coaching, training, cross-training, and clear procedures before drawing conclusions about performance. Address performance concerns consistently and respectfully, recognize contributions, and support constructive disagreement and early escalation.

Outcome - Staff understand their responsibilities, can obtain support, and demonstrate growing capability and reliable follow-through.

• Develop and recommend a phased compliance roadmap aligned with mission needs, obligations, risk, and capacity. Translate the approved plan into assignments and milestones. Develop staffing and budget proposals, manage approved resources, and explain trade-offs to the supervising leader.

Outcome - An achievable roadmap with owners, milestones, and resource needs.

• Evolve procedures for audit intake, scope confirmation, request tracking, evidence collection, quality review, submission, and follow-up. Maintain an audit calendar and request register. Define owners, deadlines, version control, and traceability to the requirement, system, and assessment period. Reuse evidence when valid and verify that it demonstrates the control being assessed.

Outcome - Timely, reliable submissions with less rework and duplication.

• Support the Director of Technology, I&S, who owns the formal Office of the State Auditor communications and coordinates executive testimony before the Legislative Audit Committee.
• Coordinate delegated logistics and evidence exchanges. Document auditor expectations and unresolved questions. Escalate disputes and threatened deadlines promptly. Distinguish internal validation from auditor's assessment of implementation.

Outcome - Substantiated responses, status reporting, and appropriately authorized commitments.

• Maintain corrective-action plans with owners, milestones, dependencies, and validation requirements. Identify root causes, coordinate priorities with the Risk Manager and system and business owners. Report overdue actions and unresolved exposure; route exception and risk-acceptance recommendations to authorized decision makers.

Outcome - Sustainable fixes, supported completion claims, and visible unresolved exposure.

• Maintain a requirements inventory and review policies and procedures with accountable owners. Propose updates and support consistent with established CISPs and Technical Standards. Pilot improvements and revise when necessary using feedback. Define workflow and evidence-automation requirements with engineering, architecture, and procurement partners.

Outcome - Current, usable procedures and reliable improvements that reduce manual effort.

• Maintain a dashboard, regular leadership updates, quarterly posture reviews, and an annual assessment. Report evidence quality, overdue actions, recurring findings, workload, capability gaps, and roadmap progress. Distinguish documentation, implementation, tested effectiveness, and externally verified status.

Outcome - Clear progress, exposure, capacity, and decision reporting.

• Actively engage in improving leadership skills, attitudes, and knowledge, especially as related to equity, diversity, and inclusion. Attend training, development, and group training on topics of inclusive leadership.

Minimum Qualifications, Substitutions, Conditions of Employment & Appeal Rights
A wide salary range is posted for this position and any job offer is based upon a salary analysis to comply with the Colorado Equal Pay for Equal Work Act. The salary analysis considers relevant experience, education, certifications, and state seniority as compared to others doing substantially similar work. While most salary offers are made within the posted range, occasionally an offer is made below or above the posted range based upon this salary analysis.

This is a skills-based job announcement. The required minimum qualifications and/or education (if substituting for the proven experience, knowledge, and skills), are as follows:
Minimum Qualifications:

• At least six (6) years of professional experience managing an information security compliance, IT audit, assurance, governance, or risk program, including direct supervision and development of staff.
• Demonstrated experience leading the development or transformation of an enterprise compliance, audit, or assurance program, including the design of governance, processes, and accountability structures.

Substitutions:

• Additional appropriate education will substitute for the required experience on a year-for-year basis, but cannot completely substitute for these qualifications.
• Training or Certification related to the work assigned to the position will be assigned credit towards substitution for experience and/or education, but cannot completely substitute for these qualifications.
• If the minimum qualifications include a degree requirement, additional appropriate paid or unpaid experience will substitute for the required education on a year-for-year basis.

Preferred Qualifications:

• Industry certifications (e.g., CISM, CISSP, CGEIT).
• Demonstrated experience leading the development or transformation of an enterprise compliance, audit, or assurance program, including the design of governance, processes, and accountability structures.
• Experience directing automated compliance or Policy as Code initiatives.
• Experience establishing or improving assessment, evidence-management, audit-response, or corrective-action processes and sustaining those improvements over time.
• Experience setting priorities, assigning work, coaching staff, managing performance, and addressing skill or capacity gaps with specific support and expectations.
• Experience coordinating complex compliance matters with technical specialists, program owners, executive leadership, and external auditors, regulators or independent oversight bodies.
• Ability to identify systemic weaknesses, evaluate evidence,m translate findings into practical improvements, and communicate recommendations and resource needs to decision makers.

Conditions of Employment:
OIT employees must comply with any screening procedures in place at state agency locations where they might perform work.

A pre-employment background check will be conducted as part of the selection process. Post-employment background checks will be required for specific agencies as business needs dictate, which may include a polygraph exam, fingerprint-based criminal history search, reference checks, and a drug test.

This position may require travel within the specified geographic area, and to locations across the state as needed.
Supplemental Information
If this posting indicates "remote from anywhere in CO" in the title, periodic reporting to the primary state work location designated for the position is required. All remote work must be performed in Colorado.

While candidates from out of state will be considered for this role, the candidate selected for the position must relocate and reside in Colorado on the first day of their new position. A reasonable timeframe for relocation will be established on an individual basis, while considering business needs, and determining a start date.
We know it's important to support each other, and that means having a healthy balance of work and personal time. Visit our benefits to learn more about some of our great offerings that allow us all to have fulfilling lives.

Visit our How to Apply webpage to learn more about our application process and what to expect after you apply.

01

Describe the top 3 outcomes you have achieved that you believe are relevant to this role.
02

Describe your experience managing and leading people, including the size and roles of teams you have supervised. How do you establish clear expectations, coach and develop employees, address performance concerns, and build a culture of accountability and collaboration?
03

Outline the experience leading the development or transformation of an enterprise compliance, audit, or assurance program, including the design of governance, processes, and accountability structures.
04

Describe your communication style and how you adapt it when working with employees, executive leadership, technical experts, and auditors.
05

Please describe how you learned of this job opening.
06

The Governor's Office of Information Technology (OIT) complies with Colorado's Equal Pay for Equal Work Act. While a wide salary range is posted, specific criteria (experience, education, state seniority, etc.) will be used to determine any salary offer. While most salary offers