Manager, IT Security

OUR TEAM: Promega's IT Security team protects a global life sciences company with sites across North America, Europe, Asia Pacific and Latin America, a hybrid cloud and on premises environment, and research, manufacturing and quality systems that people depend on to do science. We are a small, senior team where everyone owns real scope and nobody is handed a narrow lane.

Right now we are building in two directions at once. We are standing up a formal certification program spanning ISO 27001, SOC 2 and regulatory requirements across the regions we operate in, and we are writing the governance model for enterprise AI as the company adopts it across every function. That second piece puts us ahead of most organizations our size, and it means the work is genuinely new rather than a repeat of what you have done before.
Promega is privately held and known for treating people well over the long term. Security here is supported and funded, not tolerated.

YOUR ROLE: You will lead Promega's IT Security team and own how we protect the company's people, data and systems worldwide. That means security operations and incident response day to day, and it means driving the longer programs that determine whether we are actually getting safer: vulnerability and remediation management, identity and zero trust, certification readiness, and the security of a rapidly expanding set of AI tools and employee built applications.

This is a hands on leadership role. You will coach and develop a team of experienced security professionals, and you will be close enough to the technical work to make real decisions rather than approve other people's.

Just as important, you will build the relationships that make security work. Much of what we assess now originates outside IT, and your effectiveness will depend on people bringing you in while they are still deciding what to build rather than after. You will partner with teams across the business to understand what they are trying to accomplish and help them get there safely. You will be the person who explains risk clearly to leadership when a decision needs to be made, and the person the business trusts to say yes with conditions rather than simply no.

If you want a role where security is a growth program rather than a cost center, and where AI security is a current problem rather than a future one, this is that role.

JOB OBJECTIVE: Leads Promega's IT Security team in protecting the company's people, data, and systems across a global life sciences environment. Accountable for security operations, incident response, risk management, and compliance, while building a skilled, engaged and AI-enabled team that partners with the business to make security practical and easy to follow. Ensures the organization's growing use of AI is itself protected, safeguarding AI tool use and the data behind it and defending against emerging AI-driven attack vectors, while applying AI to strengthen threat detection and remediation across Promega's layered architecture. Sets direction for security practices that balance strong protection with business agility.

CORE DUTIES:

1. Leads, hires, coaches, and develops a team of security professionals, setting clear goals, providing regular feedback, and supporting career growth.

2. Owns the security operations program, including threat monitoring, vulnerability management, and timely remediation of risks across infrastructure, endpoints, cloud, and applications, applying AI capabilities to strengthen threat detection, proactive vulnerability discovery, and remediation. Accountable for remediation follow-through on identified findings, including penetration test results, audit findings, and vulnerability disclosures, with documented ownership and closure dates.

3. Directs incident response activities, maintains incident playbooks, leads post-incident reviews, and ensures lessons learned are applied.

4. Drives adoption of identity and zero trust principles, including access governance, privileged access controls, and multifactor authentication.

5. Maintains alignment with the NIST Cybersecurity Framework and applicable regulatory and certification requirements, including ISO 27001, SOC 2, NIS2, the EU Cyber Resilience Act, and UK Cyber Essentials, and ensures compliance evidence is continuously audit-ready.

6. Partners with IT teams and business leaders to embed secure‑by‑design practices into projects, vendor selections, and system changes, including environments handling regulated or GxP data.

7. Leads security assessment and governance of AI tools, model connectors, and citizen developer platforms, including risk rating, conditions of use, and ongoing review as capabilities change. Protects the data flowing through these tools while defending against emerging AI‑specific attack vectors such as prompt injection, model manipulation, and AI‑e