You will be a key member to the IT team at Penumbra driving Security, Compliance, Project Management and Training initiative working closely with various IT departments. IT is looking for an experienced Manager with in depth knowledge of IT processes and technologies and Hybrid Infrastructure environment.This position will primarily be responsible for Penumbra’s Security and Compliance program working closely with IT actively interfacing with IT, business teams and external vendors to build risk-based security and compliance program and execution. As a head of security and compliance program that leverages collaborations and company-wide resources, facilitates information security governance, advises senior leadership on security direction and resource investments, and designs appropriate policies to manage information security risk. The complexity of this position requires a leadership approach that is engaging, imaginative, and collaborative, with a sophisticated ability to work with other leaders to set the best balance between security strategies and other priorities. This position will also be responsible for working with IT leaders to build out program management amp; training program for IT lead initiatives.WHAT YOU’LL WORK ON
- Responsible for the strategic leadership of the information security, compliance, Training and Project Management program.
- Work with leadership to oversee the formation and operations of an information security organization that is organized toward a common goal in information security.
- Manage company-wide information security and compliance governance processes, chair the Information Security Advisory Committee and lead Information Security Liaisons in the establishment of an information security program and project priorities.
- Drive the best practice and robust Project Management Office for key initiative and drive few of them personally
- Provide leadership philosophy for the Information Security Office to create a strong bridge between organizations, build respect for the contributions of all and bring groups together to share information and resources and create better decisions, policies and practices.
- Mentor the Information Security Office team members and implement professional development plans for all members of the team.
- Policy, Compliance and Audit
- Lead the development and implementation of effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.
- Lead efforts to internally assess, evaluate and make recommendations to management regarding the adequacy of the security controls for the information and technology systems.
- Coordinate and track all information technology and security related audits including scope of audits, colleges/units involved, timelines, auditing agencies and outcomes. Work with auditors as appropriate to keep audit focus in scope, maintain excellent relationships with audit entities and provide a consistent perspective that continually puts the organization in its best light. Provide guidance, evaluation and advocacy on audit responses.
- Develop a strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors, PCI, ITAR, HIPAA, and FISMA.
- Outreach, Education and Training
- Work closely with IT leaders across a wide variety of security, compliance and adoption issues that require an in-depth understanding of the IT environment in their units, as well as the research landscape and federal regulations that pertain to their unit's research areas.
- Create education and awareness programs and advise operating units at all levels on security issues, technology adoption and best practices.
- Work with groups such as Network Managers, Information Security Liaisons and technical organizations such as Information Technology Services to build awareness and a sense of common purpose around security, compliance, project management and training
- Risk Management and Incident Response
- Keep abreast of security incidents and act as primary control point during significant information security incidents. Convene a Security Incident Response Team (SIRT) as needed, or requested, in addressing and investigating security incidences that arise.
- Convene Ad Hoc Security Committee as appropriate and provide leadership for breach response and notification actions.
- Develop, implement and administer technical security standards, as well as a suite of security services and tools to address and mitigate security risk.
- Provide leadership, direction and guidance in assessing and evaluatin