Note: The job is a remote job and is open to candidates in USA. Mainstay Technologies provides IT and information security services to small and medium-sized businesses. The Information Security Program Manager leads client security governance and program development, with a focus on CMMC readiness, compliance, risk management, documentation, and security operations.
Responsibilities
- Lead client governance meetings and security program reviews
- Develop and manage client security roadmaps and strategic initiatives
- Provide security guidance to executive leadership and key stakeholders
- Track program goals, projects, milestones, and security initiatives
- Coordinate activities between clients, technical teams, security operations, and third-party partners
- Present security posture, compliance status, risks, and recommendations to client leadership
- Drive continuous improvement of client security programs
- Serve as a subject matter expert on CMMC, NIST 800-171, HIPAA, and related security frameworks
- Conduct compliance assessments, gap analyses, and readiness reviews
- Interpret security, regulatory, and contractual requirements
- Develop remediation plans to address compliance gaps
- Guide clients through CMMC assessment preparation and readiness activities
- Coordinate evidence collection, assessment planning, and audit support
- Stay current on evolving compliance requirements and industry best practices
- Provide compliance recommendations and implementation guidance
- Conduct security risk assessments and program reviews
- Maintain oversight of client risk registers and remediation activities
- Identify, evaluate, and prioritize business, operational, and security risks
- Develop risk treatment and mitigation recommendations
- Facilitate risk review discussions and risk acceptance decisions
- Provide strategic recommendations to improve security maturity and resilience
- Support vulnerability, application, vendor, and operational risk review activities
- Develop and maintain: + System Security Plans (SSP) + Written Information Security Programs (WISP) + Plans of Action & Milestones (POA&M) + Policies, Procedures, and Standards + Governance and assessment documentation
- Align documentation with implemented controls and compliance requirements
- Maintain traceability between requirements, risks, controls, findings, and remediation activities
- Review and update documentation based on regulatory, business, and technology changes
- Support standardization and continuous improvement of security program documentation
- Lead security awareness and compliance training initiatives
- Facilitate tabletop exercises and security program testing
- Oversee incident response planning and program readiness
- Participate in significant security incidents as an advisor and coordinator
- Conduct post-incident reviews and lessons-learned activities
- Ensure incidents, findings, and corrective actions are incorporated into risk management and governance processes
- Support application security reviews, vendor risk reviews, and continuous monitoring initiatives
- Promote security best practices across client organizations
Skills
- Experience supporting CMMC readiness initiatives
- Experience assisting clients through audits or certification assessments
- Experience in consulting or managed services environments
- Experience presenting to executive leadership teams
- Creative problem-solving skills with the ability to take multiple components and pull them together into recommendations
- Strong decision-making skills and comfortable in situations where there is no “right” answer
- Strong organization and project management skills
- Business acumen- understanding business process, data flows, and system application use in a variety of business settings
- Technical aptitude- the ability to understand technical concepts, tools, and the IT landscape
- Strong written and oral communication skills with the ability to coordinate and run successful meetings
- Life-long learner with a growth mindset that enjoys the pursuit of knowledge and is eager to stay updated in security policies and skill
- CISA
- CISM
- CMMC Certified Professional (CCP)
- CISSP
Benefits
- A flexible and fun work environment with events, lunch+ learns, ping pong, snacks, games, and books
- 3 weeks of PTO (4 weeks after 2 years) per year
- A 2-week sabbatical at 5 years and a 5-week sabbatical at 10 years
- Health, Dental, and Vision Insurance
- Disability Insurance
- Group and Supplemental Life Insurance
- Paid Family Leave
- 401(k) with 3% match
- Team Profit Sharing
- Training program, including paid certifications, tuition reimbursement, and bonuses on achieving certs
- Paid Volunteer Time Off
- Strong flexibility to work remotely; team members can choose the mix of home and in-office work that best supports their wellbeing and effectiveness. Coming into the office weekly is encouraged, but not required.
Company Overview