Overview In this role you will guide NYSTEC's information security compliance program, aligning risk-based security controls with regulatory requirements. You will partner with leadership to drive governance, risk, and compliance across the company, ensuring secure operations and regulatory alignment. You'll translate evolving requirements into actionable security controls and oversee audits and remediation efforts. You will lead cross-functional teams to integrate security into technology and business initiatives, delivering measurable improvements in security posture and resilience.
Responsibilities- Lead and develop the information security team with clear priorities and professional development
- Oversee governance, risk, and compliance program including policies, controls, and risk management
- Ensure compliance with frameworks such as CMMC, HIPAA/HITRUST, and state/federal regulations
- Translate regulatory requirements into actionable security controls
- Advise senior leadership on cybersecurity risk, posture, and business impact
- Oversee security audits/assessments, remediation, and ongoing compliance monitoring
- Partner with business and technical leaders to embed security and data protection into processes and initiatives
- Provide leadership for enterprise security initiatives and incident/vulnerability response
- Operate under a hybrid model with on-site work two days per week
Key requirements- Knowledge of enterprise IT goals and cybersecurity requirements
- Familiarity with laws, policies, and governance frameworks relevant to cybersecurity
- Proficiency with Windows, Office, email, and internet tools
- Experience developing and supporting security standards and procedures
- Experience with security technologies (firewalls, IDS, DMZs, IPSec, DNS, SMTP, HTTP proxies)
- Knowledge of security best practices across Windows, Microsoft 365, and Cisco IOS
- Project management skills for coordinating priorities and multitasking
- Strong written and verbal communication, time management, and organization
- Experience with GRC tools (e.g., Hyperproof) to document risks and controls
- Leadership
- Strategic thinking
- Cross-functional collaboration
- Security controls development
- GRC tools (Hyperproof)
- Knowledge of CMMC, HIPAA/HITRUST
