Information Security Manager ONI

Security Governance, Risk and ComplianceResponsibilities include, but are not limited to, the following:Operate and mature the enterprise security program in partnership with the Director of IT, aligning security investments and projects to identified risks and business requirements.
Direct recurring risk assessments and control audits across ONI and its affiliate companies; maintain the enterprise risk register and drive remediation items to closure.
Develop, maintain, and socialize security policies, standards, and procedures, mapping controls to a recognized framework (NIST 800-53, NIST SP 800-171, and or CMMC) and keeping documentation audit-ready.
Own responses to customer security questionnaires, cyber insurance applications and attestations, and contractual or regulatory security obligations (e.g., CMMC, customer-specific requirements).
Assist resource owners and IT staff at affiliate companies in understanding and remediating security audit findings reported by internal and external auditors.
Threat Detection, Incident Response and Security OperationsResponsibilities include, but are not limited to, the following:Manage high-severity incident response end to end, including triage, containment, forensic analysis, executive communication, and post-incident review.
Maintain and regularly test the incident response plan and supporting playbooks; coordinate tabletop exercises with IT and business leadership.
Direct the operational management of vulnerability management, SIEM and managed detection and response services, threat intelligence platforms, and dark web monitoring.
Manage MSSP and security vendor performance against service levels, escalating and remediating gaps in coverage or responsiveness.
Security Architecture and TechnologyResponsibilities include, but are not limited to, the following:Ensure consistent application of security standards and provide configuration guidance and change control for firewall, asset management, endpoint, and backup and recovery systems.
Strengthen identity and cloud security across the Microsoft estate, including Active Directory and Entra ID, Conditional Access, privileged access management, Microsoft Defender, Intune, and overall Microsoft 365 and SaaS security posture.
Partner with plant and operations leadership to extend asset visibility, network segmentation, and monitoring into OT/ICS and manufacturing environments, accounting for the availability and safety constraints unique to plant-floor systems.
Evaluate, pilot, and recommend new security technologies, and lead their implementation across ONI and affiliate environments.
Data Protection and Emerging Technology GovernanceResponsibilities include, but are not limited to, the following:Lead data classification, data loss prevention, and insider risk initiatives, prioritizing protection of the company's most sensitive business and customer information.
Establish and maintain governance for artificial intelligence and other emerging technologies, including acceptable use standards, data handling requirements, vendor and model review, and monitoring for unsanctioned tool usage.
Third-Party and Vendor RiskResponsibilities include, but are not limited to, the following:Oversee third-party risk assessments, including vendor due diligence, security and privacy terms in contracts, and ongoing monitoring of critical suppliers and service providers.
Maintain an inventory of third parties with access to ONI systems or data, along with the assessed risk associated with each.
Leadership, Awareness and ReportingResponsibilities include, but are not limited to, the following:Supervise the Cybersecurity Engineer and other assigned security staff — setting objectives, guiding performance, and supporting professional development.
Manage the delivery and measure the effectiveness of security awareness and training programs, including phishing simulation and role-based training.
Lead the reporting and analysis of cybersecurity metrics and KPIs for both operational and executive audiences, including periodic updates to senior leadership.
Lead cross-functional project teams, defining scope, schedule, and resource requirements, and delivering security projects on time and on budget.
Required Skills, Abilities and EducationResponsibilities include, but are not limited to, the following:A minimum of five years of IT experience, including at least three years in a dedicated information security role and at least two years in a supervisory or team-lead capacity.
Bachelor's degree or higher in Cybersecurity, Information Security, Information Systems, Engineering, Computer Science, or a related field of study. Equivalent experience combined with relevant certification will be considered.
Demonstrated experience in risk assessment, incident management, and project management.
Working knowledge of a recognized security framework (NIST 800-53, NIST SP 800-171, CMMC, CIS Controls, or ISO 27001) and experience mapping controls and evidence to it.
Strong writte