Manager, IT Security

ROLE SUMMARY:
The Manager, IT Security is responsible for leading the strategy, governance, and day-to-day operations of the 
organization's IT Security program across the company. This role provides both strategic direction and hands-on 
leadership for security operations, risk management, compliance, and incident response, ensuring the confidentiality, 
integrity, and availability of information systems. The Manager leads a team of IT Security specialists, sets security 
policy and standards, and partners closely with IT, OT, Cybersecurity and business, to embed security into every 
technology and business initiative. 


ROLES & RESPONSIBILITIES: 
• Develop, own, and continuously refine the enterprise IT security strategy, roadmap, and reference architecture 
aligned with ISO 27001, NIST, and applicable national/industry regulations. 
• Lead, mentor, and manage the IT Security team (Senior Specialists and Specialists), including workload planning, 
performance management, capability development, and succession planning. 
• Direct the implementation and administration of enterprise security technologies, including firewalls, IDS/IPS, 
endpoint protection, anti-malware, email security gateways, SIEM, vulnerability management, and Privileged 
Access Management (PAM) solutions. 
• Oversee enterprise risk assessments, vulnerability management programs, and penetration testing exercises; 
prioritize, track, and report on remediation of identified risks. 
• Own the organization's security incident response program — lead major incident and breach response, forensic 
investigations, root cause analysis, and post-incident reviews. 
• Establish, maintain, and regularly test disaster recovery (DR) and business continuity plans (BCP) for security
critical systems and services. 
• Develop, approve, and enforce information security policies, standards, procedures, and guidelines across the 
organization; drive ongoing security awareness and training programs for all employees. 
• Ensure compliance with applicable regulatory, contractual, and industry frameworks (ISO 27001, NIST, SOX, 
GDPR/PDPL, SOC 2, etc.), and act as the primary point of contact for internal and external security audits. 
• Manage the IT Security budget, vendor relationships, contract negotiations, and procurement of security tools and 
services in collaboration with Procurement and Finance. 
• Experience in IT Infrastructure, Network, Applications, Cloud, and Service Desk teams to embed security-by-design 
principles into projects, systems, and change management processes. 
• Provide regular reporting and dashboards on security posture, risk exposure, KPIs, and incident trends to IT 
leadership and executive management.


QUALIFICATION & EDUCATION: 
• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field; a master’s degree or 
professional certification in Information Security/Management is preferred.


EXPERIENCE:  
• Minimum of 10 years of progressive experience in IT/cybersecurity, including at least 3-5 years in managerial or 
team-lead capacity overseeing IT security operations.

SKILLS:
Technical Skills 
• Strong knowledge of security frameworks and standards (ISO 27001, NIST CSF/SP 800-53, COBIT). 
• Hands-on and strategic experience with SIEM, vulnerability management, IDS/IPS, firewalls, endpoint protection, 
PAM, and email security platforms. 
• Solid understanding of cloud security (Azure, AWS), network security fundamentals, and identity and access 
management (Active Directory, Azure AD/Entra ID). 
• Familiarity with servers, virtualization (VMware, Hyper-V), Networks and container security (Docker, Kubernetes). 
• Working knowledge of scripting/automation (PowerShell, Python, Bash) to support security operations and 
reporting. 
• Strong understanding of ITSM/ITIL practices, change management, and IT governance frameworks. 
Soft Skills and Leadership Competencies 
• Proven leadership, team management, coaching, and mentoring capabilities. 
• Excellent stakeholder management and executive communication skills, with the ability to translate technical risk 
into business terms. 
• Strong analytical, decision-making, and crisis-management skills, particularly during security incidents. 
• Ability to manage budgets, vendors, and multiple concurrent projects and priorities.