Information Security Manager

The Information Security Manager manages the implementation and ongoing operation of the New York Genome Center’s (‘NYGC’) information security program to protect clinical, research, and business information. The role coordinates security operations, risk assessments, compliance activities, policy development, and incident response across enterprise systems, cloud services, and research environments.

Working with IT and organizational leadership, and external security providers, the Manager translates security priorities into actionable plans, coordinates implementation and reports material risks, program progress, and resource needs to leadership.

Key Responsibilities

Security Program Management and Governance

• Manage the security program’s annual work plan and implementation of approved priorities.

• Author, maintain, and coordinate approval of information security policies, standards, and procedures.

• Coordinate policy implementation, employee communications, periodic reviews, and exception documentation.

• Coordinate external security service providers and monitor delivery against agreed service expectations.

• Develop security budget recommendations, evaluate proposed tools and services, and track approved expenditures.

• Maintain security metrics and report program performance, control gaps, and resource needs to leadership.

Risk Management and Compliance

• Conduct and coordinate security risk assessments; maintain the risk register and track remediation plans.

• Apply the NIST Cybersecurity Framework to assess security capabilities, identify gaps, and recommend prioritized improvements.

• Document risk treatment recommendations and route exceptions and risk acceptance decisions to authorized leadership.

• Support applicable HIPAA Security Rule compliance activities, including risk analysis, safeguard implementation, policy documentation, and corrective actions.

• Coordinate security audits, evidence collection, control assessments, and responses to findings.

• Conduct vendor security assessments, review contractual security requirements, and respond to external security questionnaires.

• Support security obligations associated with research agreements, grants, contracts, and data-use arrangements.

Security Operations and Technical Risk Management

• Coordinate daily security monitoring, alert escalation, vulnerability management, and remediation tracking.

• Coordinate with external monitoring providers; maintain investigation and escalation procedures.

• Coordinate vulnerability assessments and penetration testing, prioritize findings with IT and system owners, and track corrective actions to completion.

• Monitor the coverage and effectiveness of endpoint, identity, email, network, cloud, and logging controls.

• Coordinate security-tool deployment, configuration, integration, tuning, and maintenance with technical teams.

• Partner with IT and system owners on secure configurations, privileged access, access reviews, and account lifecycle controls.

Incident Response and Recovery

• Maintain and exercise the incident response plan and supporting operational playbooks.

• Coordinate security investigations, containment, recovery, and post-incident corrective actions, escalating significant incidents to leadership..

• Maintain incident documentation and communicate findings to designated stakeholders.

• Partner with IT and operational owners on backup security, recovery planning, and exercises.

• Participate in after-hours incident response under established coverage arrangements.

Research Data Protection and Security Awareness

• Partner with researchers, clinical teams, and IT to secure sensitive data access, storage, transfer, and collaboration.

• Review proposed systems and workflows and recommend practical security safeguards.

• Develop and deliver security awareness training, phishing education, and guidance for specialized teams.

• Communicate security requirements clearly and help stakeholders implement them.

Required Qualifications

• Bachelor’s degree in information security, computer science, or a related field, or equivalent relevant experience.

• At least 5 years of progressively responsible information security experience, including at least 2 years managing security projects, operational functions, or program components.

• Demonstrated experience applying the NIST Cybersecurity Framework to assess controls, identify gaps, prioritize improvements, and track remediation.

• Demonstrated experience with security risk assessments, incident response, vulnerability management, and third-party security risk.

• Experience authoring and revising security policies, standards, and procedures and coordinating their review and implementation.

• Experience implementing, monitoring or coordinating security controls across identity systems, endpoints, networks, cloud services, and monitoring platforms.

• Experience coordinating technical teams and vendors and presenting actionable security recommendations to management.

Preferred Qualifications

• CISSP, CISM, or a comparable security certification.

• Experience in healthcare, genomics, academic research, or another environment handling sensitive clinical or research information.

• Experience supporting federally funded research or implementing contractual, sponsor, or data-use security requirements.

• Experience applying NIST SP 800-53 or SP 800-171 to applicable security obligations.

• Experience managing external security providers.

Competencies

• Technical and Professional Skills: Demonstrates strong judgment, integrity, discipline, and reliability; appropriately prioritizes work, manages expectations, and consistently delivers on commitments..

• Collaborative & Communicative: Builds strong relationships across functions; communicates clearly and thoughtfully; listens carefully; fosters collaboration and trust..

• Adaptable & Innovative: Embraces change, anticipates challenges, develops practical solutions, and continuously seeks opportunities to improve organizational effectiveness.

• Leader and Manager: Aligns people and priorities around institutional goals; inspires collaboration; drives execution; develops talent; and translates vision into action.

Work Location

This position will require to be on site at least 2 days a week at our downtown Manhattan location. Occasional evening and weekend work may be required.

Salary & Benefits

The pay range for this position is $130,000-150,000 per year; the base pay offered may vary depending on job-related knowledge, skills, and experience.

In addition, NYGC offers a full range of medical, financial, and other benefits as well as generous time off. This includes Medical/Dental/Vision for employees & dependent(s); Vacation, Holidays, Sick, and Other Leave, including a paid winter break; a 401(k) match; Life Insurance; Flexible Spending Accounts; employee Tuition Reimbursement; an Employee Assistance Program; and much more.

About the New York Genome Center

The New York Genome Center (NYGC) is an independent, nonprofit, academic research organization dedicated to advancing genomic research. NYGC scientists and staff are furthering new approaches to diagnosing and treating neurological diseases and cancer through their unique capabilities in whole genome sequencing, RNA sequencing, state-of-the art analytics, and the development of genomic tools. NYGC concentrates specifically on disease-based research in the following areas: neuropsychiatric disease (autism, schizophrenia, bipolar); neurodegenerative disease (ALS, Alzheimer’s, Parkinson’s, Huntington’s), and cancer.

Located in Lower Manhattan, the New York Genome Center was founded by and remains closely affiliated with the leading academic medical centers and research universities in the New York region, engaging in research projects with and for these institutions. Essential to our collaborative work is an outstanding faculty, whose members typically hold a joint appointment at NYGC and a partner university. They support our scientific mission by conducting independent research in areas of mutual interest to us and the wider scientific community.

Equal Opportunity

We are committed to fostering a workplace environment that is welcoming and fair to all, ensuring that every employee has the opportunity to thrive. We believe that bringing together individuals with diverse backgrounds, experiences, and perspectives leads to greater collaboration, innovation, and discovery. Valuing and supporting each employee in reaching their full potential strengthens our organization and enhances our collective success. We recognize that creating an environment where all employees feel valued and included requires sustained effort and dedication from the entire organization.

The New York Genome Center is a VEVRAA Federal Contractor. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, creed, color, gender, religion, national origin, sexual orientation, age, disability, genetic predisposition or carrier status, protected veteran or military status, domestic violence victim status, partnership status, caregiver status, alienage or citizenship status, marital status, or any other characteristic protected by applicable law. NYGC takes affirmative action in support of its policy to hire and advance in employment individuals who are protected veterans and individuals with disabilities.

Required SkillsRequired Experience