Information Security Manager

Department:

Security Governance and Management Department

Job Overview

We are seeking a strategic and experienced Information Security GRC (Governance, Risk & Compliance) Manager to lead and mature our enterprise-wide GRC program across information security, data privacy, and telecommunications regulatory compliance. This role owns the design, execution, and continuous improvement of the GRC function — managing a team of specialists, driving risk-informed decision-making, and serving as a trusted advisor to senior leadership and the CISO.

The ideal candidate brings deep expertise in security frameworks, regulatory landscapes, and telecom-specific compliance requirements, combined with the leadership capability to build high-performing teams and influence cross-functional stakeholders at all levels.

Responsibilities & Duties

GRC Program Leadership

• Own and drive the organization's GRC strategy, roadmap, and operating model across information security, data privacy, and telecommunications compliance.
• Build, lead, and mentor a team of GRC specialists, setting clear objectives, performance expectations, and development plans.
• Report program health, risk posture, and compliance status to the CISO and senior leadership on a regular cadence.
• Define and track GRC program KPIs and OKRs (Key Performance Indicators / Objectives and Key Results), ensuring measurable outcomes and continuous improvement.

Policy & Standards Governance

• Oversee the lifecycle management of the organization's information security, privacy, and telecom compliance policy framework — including development, review, approval, and enforcement.
• Ensure policies and standards are aligned with applicable regulatory requirements, industry frameworks (e.g., ISO 27001, NIST CSF), and business objectives.
• Establish governance processes to ensure consistent communication, acknowledgment, and enforcement of policies across all business units and personnel.

Risk Management

• Lead the enterprise information security risk management program, including periodic risk assessments, risk register maintenance, and risk treatment planning.
• Provide risk-based guidance to business and technology stakeholders, translating complex risk findings into clear, actionable recommendations for executive and operational audiences.
• Develop and maintain risk appetite and tolerance statements in alignment with organizational strategy, with particular attention to telecom-specific threat vectors (e.g., SS7/Diameter signaling, SIP/VoIP, BGP/DNS, mobile core).
• Oversee third-party and vendor risk management processes, ensuring supply chain risks are identified, assessed, and mitigated.

Compliance & Audit Management

• Manage the organization's compliance posture across applicable standards and regulations, including ISO 27001, GDPR, telecom-specific regulations, and other relevant frameworks.
• Direct and coordinate internal and external audit activities — including scoping, evidence collection, stakeholder preparation, and findings remediation.
• Oversee remediation tracking for audit findings and compliance gaps, ensuring timely closure with appropriate accountability.
• Serve as the primary point of contact for regulators, external auditors, and certification bodies on all GRC-related matters.

Training & Security Awareness

• Oversee the design and delivery of a role-based security awareness and compliance training program, ensuring coverage of telecom-specific regulatory obligations.
• Drive a culture of security and compliance awareness across the organization through targeted campaigns, metrics, and executive sponsorship.
• Measure training effectiveness and adjust programs based on outcomes and emerging risk areas.

Incident & Crisis Governance

• Provide GRC oversight for security, privacy, and telecom compliance incidents — ensuring regulatory notification obligations, documentation requirements, and post-incident review processes are met.
• Maintain current knowledge of applicable federal, state, and international privacy laws, telecommunications regulations, and accreditation standards.
• Collaborate with the Security Operations and Legal teams to ensure incident response plans reflect regulatory and contractual obligations.

Stakeholder Engagement & Executive Advisory

• Act as a trusted advisor to the CISO, executive leadership, and the Board on matters of information security risk, compliance posture, and regulatory change.
• Partner with Legal, Finance, HR, Product, Engineering, and Network Operations to embed GRC practices into business processes and technology delivery.
• Represent the GRC function in cross-functional governance forums, steering committees, and customer-facing engagements where security assurance is required.

Qualifications

Education

• Bachelor's or Master's degree in Information Security, Computer Science, Law, Business Administration, or a related field.

Certifications (one or more preferred)

• CISM (Certified Information Security Manager)
• CISSP (Certified Information Systems Security Professional)
• CISA (Certified Information Systems Auditor)
• CIPP (Certified Information Privacy Professional)
• ISO 27001 Lead Implementer / Lead Auditor
• Additional telecom or risk-focused certifications are a plus

Experience

• Minimum 7–10 years of progressive experience in information security, GRC, or a related field.
• Minimum 3–5 years in a people management or team leadership role, with demonstrated ability to build and develop high-performing teams.
• Proven track record of designing and maturing GRC programs in complex, regulated environments — ideally within telecommunications, enterprise software, or critical infrastructure sectors.
• Hands-on experience managing compliance programs against ISO 27001, GDPR, NIST CSF, and telecom-specific regulatory frameworks.
• Experience engaging with external auditors, regulators, and certification bodies.

Skills & Competencies

• Strategic thinking: Ability to translate regulatory requirements and risk findings into business-aligned programs and roadmaps.
• Leadership: Demonstrated ability to lead, influence, and develop teams and cross-functional stakeholders without direct authority.
• Communication: Exceptional written and verbal communication skills; able to present complex risk and compliance topics clearly to both technical and executive audiences.
• Analytical rigor: Strong risk assessment, problem-solving, and data-driven decision-making capabilities.
• Telecom domain knowledge: Familiarity with telecom network security concepts, signaling protocols, and sector-specific regulatory obligations is highly desirable.