Information Security Manager

SecOps — Continuous Monitoring & Client Risk Management

Full-Time Remote SecOps Compliance & Risk Focus

You’ll be the person clients trust to keep their security program on track between audits. This role lives at the intersection of technical rigor and clear communication — translating control monitoring, risk findings, and compliance gaps into actionable guidance that customers can act on.

About the role

As an Information Security Manager on the Bright Defense SecOps Team, you’ll manage a portfolio of customer security programs through asynchronous collaboration, lead continuous control monitoring, assess maturity, and develop risk management strategies that strengthen client security postures. You’ll work closely with Security Consultants, Offensive Security, and other SecOps functions — and serve as the primary written voice keeping customers informed on findings, progress, and next steps.

Key responsibilities

Portfolio management

• Manage a portfolio of customer security programs with continuous oversight via async channels
• Serve as the primary point of accountability for program health, milestone tracking, and escalation
• Coordinate with assigned Security Consultants to align monitoring with each client’s overall strategy
• Participate in internal syncs and contribute to broader SecOps objectives

Control monitoring & risk

• Lead ongoing assessments of security controls against ISO 27001, SOC 2, NIST CSF, and other applicable frameworks
• Monitor and evaluate control effectiveness, maturity levels, and residual risk exposure
• Identify, track, and support remediation of control weaknesses and compliance gaps
• Maintain current records of risk assessments, audit findings, and corrective action plans

Audit & compliance readiness

• Review evidence and documentation to validate compliance posture across multiple frameworks
• Support audit readiness for SOC 2, HIPAA, ISO 27001, PCI DSS, CMMC, and related engagements
• Perform Third Party Risk Management assessments for new and existing vendors
• Respond to security questionnaires on behalf of clients within a 5-business-day SLA

Reporting & communication

• Prepare accurate, professional, and actionable written reports and customer updates
• Deliver data-driven insights and recommendations with clarity and specificity
• Ensure transparency across all customer-facing communications regarding monitoring, findings, and remediation status
• Continuously improve reporting standards, evidence management, and monitoring methodologies

Cross-functional collaboration

Security Consulting

Offensive Security

SecOps Functions

Client Stakeholders

What we’re looking for

Security & compliance (required)

• 3–6 years in information security, GRC, or compliance-adjacent roles
• Hands-on experience with SOC 2, ISO 27001, NIST CSF, HIPAA, PCI DSS, or CMMC
• Demonstrated ability to assess control effectiveness and document residual risk
• Experience conducting or supporting security audits and evidence reviews

Risk management

• Practical experience building or maintaining risk registers and treatment plans
• Familiarity with Third Party Risk Management (TPRM) processes and vendor assessments
• Ability to prioritize risk findings and translate them into business-level recommendations
• Experience completing security questionnaires (RFP, SIG, CAIQ, custom)

Communication & async work

• Exceptional written communication — client-facing reports, findings summaries, executive updates
• Comfortable managing multiple engagements through async channels (Slack, email, project tools)
• Able to communicate technical findings clearly to non-technical stakeholders

Tools & platforms

• GRC platforms — Drata, Vanta, Thoropass, or equivalent
• Asana or similar PM tools for task and program tracking
• SafeBase or equivalent for security questionnaire management
• Google Workspace or Microsoft 365 proficiency

Nice to have

• CISA, CISM, CISSP, or CRISC certification
• MSSP or consulting firm background
• Experience supporting CMMC Level 2 or ITAR-adjacent programs
• Familiarity with NYDFS 23 NYCRR Part 500 or other state-level frameworks
• Exposure to cloud security environments (AWS, Azure, GCP)
• Background in healthcare, defense, or fintech regulated industries

Performance benchmarks

5 days

SLA for security questionnaire responses

Monthly

written updates delivered to every active client

0 gaps

untracked audit findings at any point in time

Current

risk registers and corrective action logs maintained

Aligned

control monitoring mapped to each client’s framework scope

100%

TPRM assessments completed before vendor onboarding

Compensation & perks

• Competitive base salary — range shared during screening
• Remote-first with flexible working hours
• Certification reimbursement (CISA, CISM, CISSP, CRISC, and others)
• Direct collaboration with Bright Defense co-founders
• Broad client exposure across defense, healthcare, and fintech verticals
• Clear growth path toward Senior ISM or vCISO functions

Bright Defense is an equal opportunity employer. We build diverse, high-trust teams.