Manager I Information Security

NOTE: The Pay Range referenced in this job announcement only applies to applicants who perform the job within the US and to applicants classified by CRS as International Assignees. Staff hired on local payroll would follow the respective Country pay range. Your recruiter can share more about the specific salary range for your anticipated work location during the candidate selection process.

Job Summary

The Manager I, Information Security plays a key role in safeguarding the agency’s digital assets by supporting the implementation, configuration, administration, and ongoing management of information security controls. This includes protecting end-user computing systems, networks, applications, and sensitive data from unauthorized access, misuse, and cyber threats. Working closely with IT Leadership, the Manager I is also responsible for facilitating cross-functional coordination and clear communication across all levels of CRS’s technical support tiers and business units. This collaboration ensures that security initiatives are effectively integrated into day-to-day operations and long-term strategic planning. The Manager I, ensures that all information security activities are aligned with the agency’s overarching security framework, internal policies, industry standards, and applicable regulatory requirements. This role is instrumental in promoting a consistent and well-governed security posture across the agency, while also supporting the delivery of secure and reliable digital services.

Roles and Key Responsibilities

• Supervise the Information Security team, provide coaching and mentoring to junior staff.
• Oversee the design, implementation, and continuous improvement of the agency’s Information Security Management systems, projects, and initiatives.
• Advise on and lead the development, implementation, and maintenance of information security policies, procedures, and access controls to be aligned with agency standards and applicable regulatory requirements.
• Support alignment with security and privacy frameworks such as CIS Controls, ISO 27001, NIST, and GDPR by implementing and maintaining required controls.
• Lead the Security Operations (SecOps) activities, ensuring secure and timely response to incidents, threats, and vulnerabilities, and effective collaboration with our Managed Extended Detection and Response (MXDR) vendor and other third-party vendors.
• Monitor and lead the coordination of response to security incidents and threat alerts, ensuring timely remediation and up-to-date documentation.
• Review and define security anomalies; escalate and document issues according to standard operating procedures.
• Lead the monitoring of software compliance and initiate corrective actions as needed.
• Prepare and present detailed security incidents and risk reports to senior management.
• Support agency risk management, audit readiness, and security assessment activities in coordination with IT Leadership.
• Evaluate new and emerging technologies and review the recommended solutions that enhance the security posture of end-user devices, networks, and infrastructure.
• Advise on best practices and assist in aligning business needs and operational risks with technical security solutions.
• Lead the agency-wide Information Security Awareness program, including planning, execution, and measurement of impact.
• Develop and report on Key Performance Indicators (KPIs) and metrics related to the information security program.

Knowledge, Skills and Abilities

• In depth knowledge of Information risk concepts / relating business needs to security controls.
• Excellent analytical, problem solving, and decision-making skills, applied with a solution-focused attitude.
• Strong knowledge of best practices, methods, tools, and techniques used to address information security such as those embodied in ISO 27001, NIST 800 and COBIT.
• Knowledge of frameworks and best practices such as CIS, PCI DSS, the ISO 27000 family of standards, NIST Cyber Security Framework and/or Cyber Essentials.
• Ability to influence and guide business and technical leaders, promoting the adoption of standardized security practices, policies, and risk-based decision making.
• In-depth understanding of information risk management principles, and the ability to translate business needs and operational risks into appropriate and effective security controls and recommendations.

Required Languages: Fluency in English required. Fluency in French or Spanish preferred.

Travel: Must be willing to travel up to 10%.

Supervisory Responsibilities: Yes

Basic Qualifications

• Bachelor’s degree in Information Security, Computer Science, Information Technology, or related field, or equivalent experience.
• At least 5 years of progressive experience in the design, implementation, and management of Information Security systems, processes, and controls—preferably within a complex organizational or enterprise environment.
• Minimum of two years of supervisory/management experience.
• Demonstrated experience leading or supporting Information Security programs, including collaboration across cross-functional teams and coordination with technical and non-technical stakeholders.
• Strong background in Information Security incident response, including detection, investigation, containment, and recovery. Proven track record in managing complex information security projects.
• Proven experience managing security compliance initiatives, audits, and alignment with internal policies and external regulatory or industry frameworks (e.g., NIST, ISO 27001, GDPR).

Preferred Qualifications

• Master’s degree in Information Security, Computer Science, Information Technology, or related field.
• Experience with Microsoft Windows operating systems, Windows Active Directory Services, Azure AD and Microsoft 365, Enterprise Mobility and Security (EMS) and Enterprise Mobility Management (EMM).
• Experience managing Microsoft Defender XDR systems such as Defender for Endpoint, Defender for Cloud, Defender for Cloud Apps and Defender for Office365 and Azure Security Center.
• Experience with Privilege Access Management solutions, least privilege Access Management platforms and multi-factor authentication solutions among other technologies.
• Experience in managing Information Security compliance.
• Experience in providing help desk services and tools.
• ITIL Foundation certification.
• Any of the following certification is a plus: CAP, CEH, CISSP or CISM.

Agency Competencies (for all CRS Staff):

• Personal Accountability – Consistently takes responsibility for one’s own actions.
• Acts with Integrity - Consistently models values aligned with CRS Guiding Principles and mission. Is considered honest.
• Builds and Maintains Trust - Shows consistency between words and actions.
• Collaborates with Others – Works effectively in intercultural and diverse teams.
• Open to Learn – Seeks out experiences that may change perspective or provide an opportunity to learn new things.

Agency Leadership Competencies:

• Lead Change – Continually looks for ways to improve the agency through a culture of agility, openness, and innovation.
• Develops and Recognizes Others – Builds the capacity of staff to reach their full potential and enhance team and agency performance.
• Strategic Mindset – Understands role in translating, communicating, and implementing agency strategy and team priorities.

What we offer

CRS offers U.S. based staff a comprehensive benefits package, including medical, dental, life insurance, vision, and a generous retirement savings plan. Benefits packages for successful candidates employed outside the U.S. are based on the country of employment/in-country office where the candidate will perform the role. CRS´ work culture is a collaborative, mission-driven culture committed to improving the lives of the poor throughout the world.