Cyber Security & Risk Manager
Hands-on cybersecurity and risk manager at Surf Internet (a fiber ISP) in Elkhart, IN, reporting to the CIO: runs daily security monitoring, incident response, vulnerability management, compliance, vendor risk, and awareness programs while maturing the security program using the NIST Cybersecurity Framework.
- Compensation
- Not disclosed
- Location
- Elkhart Corporate - Elkhart, IN 46516
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Hands-on leadership of cybersecurity and risk management program
- Monitor security alerts, logs, and events; investigate and respond to threats in real time
- Lead all phases of incident response and maintain the Incident Response Playbook
- Draft, maintain, and enforce security policies across departments
- Analyze third-party scan reports and coordinate vulnerability remediation within SLAs
- Deliver security awareness training and phishing simulation programs
- Maintain the Information Security Risk Register and risk treatment plans
- Coordinate annual NIST CSF maturity assessments with third-party partners
- Manage vendor risk assessments and third-party risk due diligence (TPRM)
- Maintain and test business continuity and disaster recovery (BCP/DR) plans
- Coordinate tabletop exercises and readiness testing
- Track cybersecurity KPIs and report program maturity to executive leadership
- Develop cybersecurity strategy, roadmap, and governance standards using NIST CSF
- Drive security projects including tool deployments and vendor coordination
- Provide cybersecurity guidance on business, technology, infrastructure, and cloud decisions
- Reports to the Chief Information Officer within the IT department (exempt status)
Full description
Overview
The Cybersecurity & Risk Manager is a hands-on leader responsible for developing, implementing, and continuously improving the organization's cybersecurity and risk management program. This role serves as the primary cybersecurity subject matter expert, driving strategic security initiatives while actively managing daily security operations, incident response, vulnerability management, compliance activities, vendor risk assessments, and security awareness programs.
The Cybersecurity & Risk Manager partners across the organization to identify and mitigate risk, align security practices with business objectives, and mature the cybersecurity program utilizing the NIST Cybersecurity Framework (CSF) and other applicable industry standards. As the organization's security leader, this individual provides guidance to leadership, supports the protection of critical business and network infrastructure, and champions a culture of security throughout the enterprise.
Reports To: Chief Information Officer
Department: IT
Job Status: Exempt
Responsibilities:
Security Operations & Monitoring
- Monitor security alerts, logs, and events daily; investigate and respond to threats and anomalies in real time.
- Track and refine cybersecurity KPIs to support trend analysis, improvements, and leadership reporting aligned with regulatory goals.
Incident Response & Tracking
- Lead all phases of incident response, maintain and improve the Incident Response Playbook, and ensure accurate documentation and preventive actions through structured tracking and analysis.
Policy Management
- Draft, maintain, and enforce security policies; ensure accessibility and cross-department compliance with corrective actions where needed.
Vulnerability Management
- Analyze third-party scan reports, maintain a vulnerability inventory, and coordinate remediation efforts with stakeholders within defined SLAs.
User Awareness & Training
- Deliver and track security awareness programs and phishing simulations; adjust content based on performance and emerging threats.
- Manage a repeat offender remediation program for users who repeatedly fail phishing simulations, including targeted training, awareness reinforcement, performance tracking, and coordination with management when necessary.
Risk Management
- Maintain and update the organization’s Information Security Risk Register, ensuring timely tracking, ownership, and mitigation of identified risks.
- Coordinate annual enterprise cybersecurity risk and NIST maturity assessments with third-party security partners, document findings, evaluate business impact, and track remediation activities through resolution.