> Markdown version of [/jobs/ext/2706989-information-security-manager](https://www.wearedevelopers.com/jobs/ext/2706989-information-security-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Manager - **Company:** Cypress - **Location:** Durham, NC, United States - **Experience:** Expert - **Salary:** $140,000.0 - $155,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cloud Computing, Configuration Management, Cyber Security, Information Systems, Digital Forensics, Intrusion Detection and Prevention, Python (Programming Language), Performance Tuning, Windows PowerShell, Phishing, Kusto Query Language, Security Information and Event Management, Data Streaming, Software Vulnerability Management, Cloud Platform System, Cypress (Programming Language), Information Technology, Patch Management, Operational Systems, Hardware Infrastructure, Vulnerability Analysis - **Published:** September 4, 2026 - **Apply:** https://startup.jobs/information-security-manager-cypress-creek-renewables-8002905 ## About the Role * Use of AI to enhance and scale security operations - establish AI first Security Ops * Bachelor's degree in computer science, information systems, cybersecurity, or related field - or equivalent professional experience. * 5+ years of progressive experience in information security, with demonstrated depth in security operations, engineering, or a combination of both. * Hands-on administration and tuning experience with Microsoft Defender (Endpoint, Identity, Cloud). * Production experience operating Zscaler (ZIA and/or ZPA), including policy management and troubleshooting. * Strong SIEM experience - building detections, tuning alerts, investigating incidents, and onboarding log sources. * Vulnerability management experience across cloud environments, specifically AWS and Azure. * Working knowledge of digital forensics and incident response methodology. * Demonstrated experience operating a security program aligned to the NIST Cybersecurity Framework or NIST 800-53. * Track record of writing, maintaining, and operationalizing security policies and standards. * Clear written and verbal communication, including the ability to explain technical risk to non-technical audiences. * Ability to work from the Durham, NC or Washington, DC office three days per week. * Embrace and live by the mission and values of Cypress Creek Energy Preferred Qualifications * Industry certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCIA), or equivalent. * Experience operating in the energy, utility, or critical infrastructure sector. * Familiarity with NERC CIP or other regulatory frameworks relevant to the power sector. * Experience scripting or automating security workflows (Python, PowerShell, KQL). * Prior experience as a senior technical lead preparing to step into a manager role. ## Description The successful candidate brings a balance of deep technical execution and program-level compliance maturity. You will own the day-to-day security tooling stack, lead the company's NIST-based compliance program, shape policy in emerging areas including artificial intelligence, and maintain an accurate view of every system in the environment. You will report directly to the Chief Technology Officer and partner closely with IT, Counsels, and business stakeholders across the company., Security Operations & Engineering * Endpoint security: Administer and tune Microsoft Defender across the endpoint estate, including policy configuration, alert triage, response, and reporting. * Network and access security: Manage the Zscaler platform (ZIA/ZPA), including policy development, traffic inspection, access controls, and integration with identity systems. * SIEM operations: Own SIEM tuning, detection engineering, log source onboarding, alerting, and incident workflows. Build dashboards and metrics that surface meaningful signals. * Vulnerability management: Run the vulnerability scanning program across AWS and Azure cloud environments and on-premises infrastructure. Prioritize, track, and verify remediation in partnership with IT and engineering teams. * Patch management: Maintain endpoint patching cadence and reporting, ensuring coverage, exception tracking, and SLA adherence. * Digital forensics & incident response: Lead investigations into security events, perform forensic analysis, document findings, and coordinate response with internal teams and external partners as needed. Compliance & Governance * NIST-based program: Maintain and continuously improve the company's NIST Cybersecurity Framework-aligned security program, including controls mapping, evidence collection, and gap remediation. * Policy management: Own the security policy library - ensure policies and standards are current, reviewed on a defined cadence, approved through the right channels, and communicated to the business. * AI policy and guidance: Develop and maintain the company's AI usage policies, acceptable use guidance, and review process for new AI tools, in coordination with Counsels and IT. * System inventory: Build and maintain an authoritative inventory of systems, applications, data flows, and ownership. Keep it accurate as the environment evolves. * Audit and assessment support: Lead responses to internal and external audits, customer security reviews, and regulatory inquiries. Manage remediation of identified findings through closure. * Risk management: Identify, document, and track information security risks; propose mitigations and report on residual risk to leadership. Leadership & Cross-Functional Partnership * Stakeholder engagement: Partner with IT, Counsels, HR, and business leaders on security matters, providing clear guidance that balances risk with business needs. * Operational Technology (OT): Act as a partner and advisor to the OT team coordinating security and compliance initiatives across the company. Manage intersection of IT and OT endpoints, systems, and networks. * Security awareness: Drive the security awareness program, including phishing simulations, training content, and ongoing communications. * Vendor and third-party risk: Assess and manage security risk associated with vendors, contractors, and third-party service providers. * Future team leadership: Lay the groundwork to scale the function. As the program matures, hire, mentor, and lead a team of security professionals., A note to Recruiting Agencies Cypress Creek Energy Human Resources team does not accept unsolicited resumes from third party recruiters, staffing firms, or related agencies. The Human Resources team coordinates all recruiting and hiring at our company. We do not accept resumes from third-party recruiters unless authorized by the Human Resources team and if a signed agreement is in place. Any unsolicited resumes will be considered property of CCE and we are not responsible for any related fees. All communication related to recruiting partnerships should ONLY be directed to the Human Resources team. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Python-Based Data Streaming Pipelines Within Minutes](https://www.wearedevelopers.com/videos/1233-python-based-data-streaming-pipelines-within-minutes) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering) ## Related Articles - [Everything a Developer Needs to Know About MCP with Neo4j](https://www.wearedevelopers.com/magazine/604-everything-a-developer-needs-to-know-about-mcp-with-neo4j) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)