Manager I Information Security at Catholic Relief Services

About this role

NOTE: The Pay Range referenced in this job announcement only applies to applicants who perform the job within the US and to applicants classified by CRS as International Assignees. Staff hired on local payroll would follow the respective Country pay range. Your recruiter can share more about the specific salary range for your anticipated work location during the candidate selection process. Job Summary The Manager I, Information Security plays a key role in safeguarding the agency’s digital assets by supporting the implementation, configuration, administration, and ongoing management of information security controls. This includes protecting end-user computing systems, networks, applications, and sensitive data from unauthorized access, misuse, and cyber threats. Working closely with IT Leadership, the Manager I is also responsible for facilitating cross-functional coordination and clear communication across all levels of CRS’s technical support tiers and business units. This collaboration ensures that security initiatives are effectively integrated into day-to-day operations and long-term strategic planning. The Manager I, ensures that all information security activities are aligned with the agency’s overarching security framework, internal policies, industry standards, and applicable regulatory requirements. This role is instrumental in promoting a consistent and well-governed security posture across the agency, while also supporting the delivery of secure and reliable digital services. Roles and Key
Supervise the Information Security team, provide coaching and mentoring to junior staff.
Oversee the design, implementation, and continuous improvement of the agency’s Information Security Management systems, projects, and initiatives.
Advise on and lead the development, implementation, and maintenance of information security policies, procedures, and access controls to be aligned with agency standards and applicable regulatory requirements.
Support alignment with security and privacy frameworks such as CIS Controls, ISO 27001, NIST, and GDPR by implementing and maintaining required controls.
Lead the Security Operations (SecOps) activities, ensuring secure and timely response to incidents, threats, and vulnerabilities, and effective collaboration with our Managed Extended Detection and Response (MXDR) vendor and other third-party vendors.
Monitor and lead the coordination of response to security incidents and threat alerts, ensuring timely remediation and up-to-date documentation.
Review and define security anomalies; escalate and document issues according to standard operating procedures.
Lead the monitoring of software compliance and initiate corrective actions as needed.
Prepare and present detailed security incidents and risk reports to senior management.
Support agency risk management, audit readiness, and security assessment activities in coordination with IT Leadership.
Evaluate new and emerging technologies and review the recommended solutions that enhance the security posture of end-user devices, networks, and infrastructure.
Advise on best practices and assist in aligning business needs and operational risks with technical security solutions.
Lead the agency-wide Information Security Awareness program, including planning, execution, and measurement of impact.
Develop and report on Key Performance Indicators (KPIs) and metrics related to the information security program.
Knowledge, Skills and Abilities
In depth knowledge of Information risk concepts / relating business needs to security controls.
Excellent analytical, problem solving, and decision-making skills, applied with a solution-focused attitude.
Strong knowledge of best practices, methods, tools, and techniques used to address information security such as those embodied in ISO 27001, NIST 800 and COBIT.
Knowledge of frameworks and best practices such as CIS, PCI DSS, the ISO 27000 family of standards, NIST Cyber Security Framework and/or Cyber Essentials.
Ability to influence and guide business and technical leaders, promoting the adoption of standardized security practices, policies, and risk-based decision making.
In-depth understanding of information risk management principles, and the ability to translate business needs and operational risks into appropriate and effective security controls and recommendations.
Required Languages: Fluency in English required. Fluency in French or Spanish preferred. Travel: Must be willing to travel up to 10%. Supervisory : Yes Originally posted on Himalayas