Program Manager, Information Security

Company: Alaska Communications Systems
Location: Anchorage
Posted on: February 25, 2021

Job Description:

Program Manager, Information Security #3526 AK Published Job Title Program Manager, Information Security Requisition Number 3526 Location Anchorage-ANCH Job Title Program Manager, Information Security Job Description This role champions the Enterprise Security Office objective of establishing a comprehensive Enterprise Security program and ensuring compliance. This position leads the goal to bring information security, technology, and products to Alaska Communications and its customers by creating strong partnerships across business units, functional groups and external collaborators to deliver a comprehensive information security program for the organization. The individual chairs the Security Advisory Council, identifying and managing company-wide topics and workshops to fulfill information security program requirements. This role collaborates very closely with the Information Technology and Network Engineering departments and all functional organizations to measure, monitor and improve security health to ensure compliance with the overall company program. It is critical for this individual to be able to lead the development of forward-thinking, industry-leading vision and strategy to ensure Alaska Communications is a strong leader in cybersecurity. The individual will be comfortable working in a fast-paced environment, lead the development and establishment of a security strategy for Alaska Communications along with a roadmap to achieve strategic security goals. The individual must be able to see and integrate security into "the big picture" when weighing risk and operational needs of the company to develop an affordable strategy that supports strategic and operational goals while determinedly managing risk. This position is responsible for championing the security and integrity of data and has knowledge of every aspect of information security throughout the company, to analyze security controls and to determine the effectiveness of the measures. The individual leads efforts to enhance security based on financial appetite and organizational risk tolerance. Responsible for developing and implementing any training required including instructing staff on proper security measures both in the office and online. Must lead business administrators, IT and Engineering professionals to establish effective methods to discover, communicate and address vulnerabilities in computing systems and networks, championing changes to improve every aspect of company security. The role is also responsible for creating, documenting, training, exercising and otherwise testing incident response plans to help the company in case of a security incidents and breaches. Reasonable Accommodations Statement T o perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable Accommodations may be made to enable qualified individuals with disabilities to perform the essential functions. Essential Functions

• Security Strategy -- Provide technical insight and recommendations into the development and execution an enterprise security strategy and roadmap that mitigates risk through the right balance of security measures and operational flexibility.
• Standards and Guidelines -- Lead the development and implementation of optimal policies, processes, standards, tools, and guidelines that enable Alaska Communications' security strategy, and protect Alaska Communications' technology infrastructure and applications.
• Advanced Detection and Containment -- Leads in the establishment of building of an industry-leading detection, containment, and restoration capability to identify and mitigate sophisticated cyber-attacks against Alaska Communications and its customers.
• Security Engineering -- Work directly with Network and IT functions to ensure that the right security capabilities are built into offerings, enterprise processes and tools through reusable technology and process frameworks. Provide recommendations to research, evaluate, select, implement and support information and network security solutions based on threat and vulnerability assessments.
• Security Compliance and Audits -- Lead and coordinate internal and external assessments of security, disaster recovery and compliance (certification and accreditation) to include coordinating reviews and assessments with internal and external auditors. Ensure systems and networks compliance with security policies, standards, and practices, including PCI-DSS, HIPAA, SOx, SEC and Department of Homeland Security . Lead the implementation of solutions for non-compliant systems.
• Education and Training -- Lead in the development and implementation of security awareness training, information and education to employees, partners and customers.
• Third Party Management -- Champion the creation implementation and ongoing compliance monitoring of information security and privacy requirements and all associated responsibilities in vendor contracts and agreements.
• Security Metrics and Reporting -- Develops and maintains program that informs business unit and functional group leadership of the top security risks and overall security health of their organizations. Supports the Director of Enterprise Security in communicating overall security health of the entire company to Senior Leaders and the Board of Directors.
• Monitor the organization's networks and computing resources for security breaches and respond immediately to security-related incidents. Provide a thorough post-event analysis should an incident occur.
• Perform other duties not specified in this job description, as assigned. POSITION QUALIFICATIONS Competency Statement(s)
  • Technology Understanding and Expertise -- Understanding the technology trends that are of importance to your customers (internal and external) and having the skills to serve as a trusted advisor to customers in the technology space.
  • Personal leadership - Demonstrate personal leadership in all aspects of work, lead by example, and demonstrate strong personal accountability and ownership. Staying focused on the end game - and managing all dials to get to the desired outcomes.
  • Thought leadership -- Capability to maintain an active understanding of current threats to the company, within the telecom/CSP and global internetworked landscape. Drives security dialog across the organization accordingly through Security Advisory Council and fit-to-purpose meetings and activities.
  • Business and Process Understanding -- Understanding of business processes: a keen understanding of security processes and associated metrics and measurement. A keen understanding of key telecom processes (sales/service, ordering/service delivery, billing, customer support) and the ability to map processes and understand inter-linkages to each other and to the systems that support the processes. A keen sense of the big picture as is relates to balance of security and operational agility. A keen sense of how to maximize security value with allotted resources.
  • Customer Focus - An attitude of customer being the key to success, and keeping customer interests paramount. Being driven by a commitment to customer service that compels us to acquire and retain loyal customers by anticipating and exceeding their expectations.
  • Communication Skills Written & Oral -- Must have excellent oral and written communications skills. Able to succinctly describe status of business and the severity of vulnerabilities and threats.
  • Relationship Building - Effective in building company-wide relationships with senior technical, functional and business leaders to set long-term strategies and to assess and act on short-term objectives and needs.
  • Collaboration - Must champion the idea of security being a business enabler. Enjoys collaborating with colleagues across the entire organization. Must want to architect solutions rather than just breaking them.
  • Lean Leadership: Actively grows and promotes lean process improvement usage within department and within Company. Strives to eliminate all waste -- that which does not bring value to the customer -- through the use of Lean PI. MINIMUM QUALIFICATIONS Bachelor' s degree in Computer Science, Information Technology, Management Information Systems, Network Security or related field. Directly relevant experience may be substituted for the education requirement on a year-for-year basis plus eight (8) years of progressive experience in telecommunications, network and/or information security functions (e.g., strategy, operations, systems security, network monitoring, assessments incident response, investigations, consulting, and compliance) and security and privacy regulations and standards. At least eight (4) of those years should be in an Information or IT Security leadership role. Relevant advanced education may be substituted for the experience requirement on a year-for-year basis. PREFERRED: CISSP (Certified Information Systems Security Professional), CISM, CISA, CCIE, Security +, GIAC or other security certification/accreditation is desirable. Ability to formulate the cost benefit of security initiatives in the context of overall business risk mitigation and the company's operational objectives. Ability to compare, contrast and prioritize among alternative approaches to meet those objectives. Building company-wide relationships with senior technical, functional and business leaders to set long-term strategies and to assess and act on short-term objectives and needs. Testing network security technologies including: firewalls, IDS/IPS, SIEM, DDOS, and/or GRC tools. Testing and analyzing security attacks (e.g., viruses, worms, DDOS attacks, spyware), denial of service attacks, and other threats. Knowledge of Security Frameworks (e.g. ISO 2700x, NIST SP800, COBIT, HITRUST) and security regulations and standards (e.g. HIPAA, HITECH, PCI, FISMA, SOX etc.) and Carrier/Service Provider (CSP) network environments. COMPUTER SKILLS: Demonstrable proficiency using Microsoft Office Suite to include, Word, Excel, Access, Visio, and Outlook. Please complete our online application. If you need assistance or have questions, contact Rose Muncy, SHRM-CP, PHR CIR at rose.muncy@acsalaska.com or (907) 564-1259. Alaska Communications is an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race; color; religion; creed; national origin; ancestry; age; gender (or gender identification or expression); sexual orientation; mental or physical disability, except where disability is a bona fide occupational disqualification; marital status; change in marital status; parenthood; pregnancy or family relationship; status as a disabled or protected veteran; or any impermissible characteristic as defined by law. View the U.S. Department of Labor Pay Transparency Nondiscrimination Provision. `

Keywords: Alaska Communications Systems, Anchorage , Program Manager, Information Security, Executive , Anchorage, Alaska