> Markdown version of [/jobs/ext/4302140-sr-information-security-manager](https://www.wearedevelopers.com/jobs/ext/4302140-sr-information-security-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr Information Security Manager - **Company:** Market, Inc. - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $90,000.0 - $150,000.0 - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Desktop Computing, Information Security Management, IT Management, Information Technology Operations, Anti-Phishing, Software Engineering, Storage Devices, Information Technology, Vulnerability Analysis - **Published:** October 18, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=e3cde9b7867e15a0 ## About the Role Required * 5+ years of IT experience, including 2+ years in an information security role. * Excellent understanding of information security concepts, protocols, industry best practices, and strategies. * Experience with common information security management frameworks, such as ISO 2700x, NIST 800-53, and COBIT. * Experience running ISO 27001 and/or SOC 2 compliance programs, including owning controls and leading audits through to certification. * Experience developing and maintaining security policies, procedures, standards, and guidelines. * In-depth knowledge of information risk concepts and principles, and how to relate business needs to security controls. * Experience with system technology security testing (vulnerability scanning and penetration testing). * Proficiency in performing risk, business impact, control, and vulnerability assessments, and in defining treatment strategies. * Excellent analytical and project management skills, with the ability to manage multiple projects concurrently. * Excellent verbal, written, and interpersonal communication skills, including the ability to work across the IT organization, project and application teams, management, and staff. * Knowledge and understanding of relevant data privacy and security laws and regulatory requirements. Nice to Have * Experience as an information security auditor, IT risk manager, or compliance analyst. * A degree in cybersecurity or information technology, or equivalent work experience. * One or more of: CISSP, CRISC, CDPSE, CISA, CISM, or GIAC. * Familiarity with software development methodologies. ## Description We are looking for an Information Security Manager to own MPG's information security and privacy program end to end: policy, training, incident response, risk, ISO 27001 and SOC 2 compliance, and the day-to-day security posture of the systems that hold company and client data. This role reports to the VP, Information Technology, and serves as the primary point of contact for senior management, clients, and auditors on security and privacy matters. This is a hands-on role for someone who can set the policy and run the program - assessing risk, responding to incidents, and building the kind of security and privacy awareness that has to exist across the company, not just inside IT. This is a security-focused role, not a broader IT management role: infrastructure, applications, and day-to-day IT operations stay with the VP, Information Technology and the rest of the IT organization. You own the security and privacy program; you partner with IT to get it implemented. What You'll Do * Security Program & Policy * Assess people, processes, and technology across MPG to identify risk and vulnerabilities, and evaluate the effectiveness of the security and privacy program against changing laws, regulations, and industry trends. * Implement the policies that make up a comprehensive information security and privacy program: security solutions, security and privacy training, incident response, audits, business continuity and disaster recovery, risk management, and change control. * Manage the security solutions that protect MPG's applications, infrastructure, and networks, and ensure corporate networks, computers, and storage devices are monitored closely enough to catch attacks and respond to alerts quickly. * Incident Response & Risk * Run the incident management program: classify and mitigate incidents by risk level, manage the response, fix root causes so incidents do not recur, document everything formally, and communicate to internal stakeholders, clients, and government or local officials as required. * Administer a risk management program to identify, classify, report, track, and mitigate risk, including a program to manage third-party security and privacy risk. * Own the security and privacy dimensions of business continuity and disaster recovery planning - what has to be protected, restored, and communicated in a disruption - coordinating with IT infrastructure teams on execution. * Review technical changes for security impact and maintain the change control standard that keeps changes secure, without owning the broader IT change process itself. Training & Awareness * Manage security and privacy awareness training programs and email phishing campaigns across the company. Compliance & Audit * Own MPG's ISO 27001 and SOC 2 compliance programs end to end: control ownership, evidence collection, audit prep, and remediation of findings. * Serve as the primary point of contact for external auditors and certification bodies, and keep certifications current as MPG's environment and client requirements evolve. * Ensure the information security and privacy function is held to, and maintains, the highest level of confidentiality.