> Markdown version of [/jobs/ext/2294577-manager-information-security](https://www.wearedevelopers.com/jobs/ext/2294577-manager-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Manager, Information Security - **Company:** Synack's Penetration Testing - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $150,000.0 - $180,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Microsoft Azure, Cloud Engineering, Cyber Security, Continuous Integration, Query Languages, Information Technology Audit, Intrusion Detection and Prevention, Python (Programming Language), Key Management, Nagios, Open Web Application Security, Systems Development Life Cycle, Cloud Services, Security Information and Event Management, Software Engineering, Systems Integration, Datadog, Data Processing, Terraform, Devsecops - **Published:** August 29, 2026 - **Apply:** https://www.workingnomads.com/job/go/1822490/ ## About the Role * 8+ years of experience IT Security Strategy, Risk Management, IT Audit and Compliance with a Cloud Service Provider * Experience with Python, Terraform, and CI/CD pipelines, plus comfort integrating tools with AI. * Experience with Enterprise Governance, Risk Management, and Compliance (GRC) tools. * Experience with event monitoring and alerting tools such as Datadog, Stackdriver, and Azure Sentinel. * Experience with SOAR or auto-remediation platforms and detection engineering / SIEM query languages. * Experience with Cloud Native Application Protection Platforms (CNAPP). * Experience with leveraging security tools within the Software Development Lifecycle (SDLC). * Familiarity with secrets management and workload identity (non-human). * Working knowledge of security regulations, standards, and frameworks, including but not limited to ISO27000, ISO42001, OWASP, SOC2, GDPR, CMMC, FedRAMP, and NIST. * Excellent written and verbal communication skills with the ability to accurately communicate security and risk-related information to technical and non-technical audiences. Ready to join us? ## Description We are looking for a talented Information Security Compliance Manager with deep expertise in ISO, SOC, CMMC and FedRAMP compliance. You will work closely with the Product, Engineering, and Operations teams to ensure proper security controls and monitoring are applied. Sounds interesting? Keep reading… **Please note that due to federal government contract requirements, we can only hire a citizen of the United States into this role. Here's what you'll do * Automate generation of System Security Plans (SSP), including Security Concept of Operations, Risk Management Matrix, Security Control Traceability Matrix, and conduct Security Impact Analysis (SIA) on major system changes. * Develop and maintain automated Plans of Action and Milestones (POAMs). * Contribute to the adoption and implementation of automation and use of Artificial Intelligence (AI) within Synack's Information Security operations. * Own the inventory and risk assessments of AI/agentic systems used across Synack, aligned to NIST AI RMF and ISO 42001, including data handling, model and agent change control, non-human identity and credential scoping. * Build and own automated evidence collection and control-drift around security controls. * Communicate regularly with stakeholders on security compliance issues aligning to CIS and NIST standards, track mitigation/remediation tasks, and assisting in generation of reports and metrics. * Codify security controls into IaC guardrails, CNAPP policies, and CI/CD checks to prevent risks at commit and deploy time. * Working with Project Managers and Software Engineers in a collaborative and enabling (non-obstructive) manner; Ensuring appropriate information security policies, standards, procedures, and guidelines are being incorporated across Synack hosted services and infrastructure, with a focus on hardening and adhering to DevSecOps principles. * Coordinate with the field teams to respond to vendor security assessments and conduct 3rd party risk assessments of Synack vendors. ## Related Videos - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Debugging in the Dark](https://www.wearedevelopers.com/videos/1658-debugging-in-the-dark) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)