{"id":3710686,"url":"https://alion.io/job/cornerstone-ondemand-senior-cybersecurity-program-manager","title":"Senior Cybersecurity Program Manager","company":{"id":6504,"name":"Cornerstone OnDemand","domain":"cornerstoneondemand.com","url":"https://alion.io/company/cornerstone-ondemand","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Cornerstone","truth_index":{"grade":"B","score":81,"open_postings":9,"ghost_share":0,"stale_share":0.778,"repost_share":0,"time_to_fill_p50_days":25,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"FedRAMP","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-11-03T12:00:00Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-08T08:38:38Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"The Sr. Cybersecurity Program Manager is a critical business and compliance role responsible for operational governance, customer assurance, audit readiness, and continuous monitoring of Cornerstone public sector cloud offerings in Canada and the United States. The role leads and coordinates activities supporting Government of Canada Protected B services, FedRAMP Moderate, and the AWS GovCloud / DoD Impact Level 4 (IL4) environment.\nThe successful candidate ensures authorization commitments are translated into sustainable operating processes, clearly assigned ownership, timely evidence, effective remediation, and transparent government and executive reporting. The role coordinates annual assessments, continuous monitoring, POA M management, vulnerability governance, corrective action plans, audit evidence, control-owner accountability, customer onboarding readiness, and development of the Cornerstone Protected B solution. This role will support the overall vision of the Cybersecurity Program at Cornerstone OnDemand.\nThis position is part of the global Cybersecurity Engineering and Assurance team and reports to the Sr. Director, Quality Risk Management. In this role you will...\nPublic Sector Program Leadership Own the integrated cybersecurity program plan, governance cadence, milestones, dependencies, risks, and executive reporting for Protected B, FedRAMP Moderate, and DoD IL4 initiatives. Serve as a senior program interface across Cybersecurity, Quality Risk Management, Cloud Operations, Engineering, Product, Legal, Sales, Customer Success, external assessors, government sponsors, and authorizing organizations. Maintain clear RACI assignments, named control owners, backup coverage, decision logs, risk acceptance records, and escalation paths to avoid single points of failure.\nTranslate regulatory, authorization, contractual, and customer requirements into actionable work plans and measurable operational outcomes. Protected B - Canada Lead cybersecurity program management for existing Protected B services and development, readiness, and operationalization of the Cornerstone Protected B solution. Coordinate alignment with Government of Canada security expectations, including ITSG-33 risk management practices, applicable cloud control requirements, security assessment and authorization activities, and continuous monitoring.\nSupport designated Canadian security responsibilities, including government and customer communications, evidence coordination, control ownership, personnel/access requirements, security documentation, and assessment support. Coordinate data-handling, access, residency, subcontractor, incident, and shared-responsibility requirements applicable to Protected B services. FedRAMP Moderate Coordinate FedRAMP Moderate authorization maintenance, annual assessments, control implementation reviews, evidence collection, assessor interviews, continuous monitoring deliverables, POA M updates, significant-change activities, and customer assurance requests.\nMaintain program oversight of the authorization boundary, SSP, control implementation statements, policies, procedures, inventories, diagrams, customer responsibility documentation, and supporting evidence. Ensure findings, risks, and compliance obligations have accountable owners, are tracked to closure, and are escalated when authorization commitments are at risk. DoD IL4, DISA and GovCloud Lead cybersecurity program coordination for the DoD IL4 GovCloud environment, including DISA and mission-owner engagements, authorization maintenance, eMASS package coordination, annual 3PAO assessments, continuous monitoring, and customer onboarding readiness.\nCoordinate responses to DISA requests, corrective action plans, authorization conditions or restrictions, follow-up questions, evidence requests, and remediation commitments, maintaining complete records of decisions, submissions, approvals, and due dates. Oversee vulnerability governance across operating systems, containers, repositories, base images, applications, and infrastructure, including named owners, remediation plans, recurring dashboards, POA M traceability, deviation/risk-acceptance workflows, and evidence. Ensure reporting provides transparent status of out-of-SLA vulnerabilities, externally or customer-facing exposure, authentication and authorization impacts, remediation progress, and residual risk.\nCoordinate GovCloud audit readiness, including control-owner assignments, SSP and IL4 addendum reviews, evidence handling, interview preparation, system demonstrations, CUI-aware screen sharing, assessor follow-ups, and final evidence submission. Governance, Risk and Executive Communication Maintain integrated risk registers, corrective action trackers, audit plans, control-owner matrices, compliance dashboards, and executive reporting. Establish governance forums with clear decisions, owners, due dates, and escalation criteria across Security, Cloud Operations, Engineering, and business stakeholders.\nDrive root-cause analysis and durable corrective actions for missed assessments, late remediation, evidence gaps, unclear ownership, reduced operational capacity, or insufficient government communication. Provide concise, fact-based communications to executives, customers, assessors, and government representatives while protecting CUI, Protected B, security-sensitive information, and authorization package materials. You’ve got what it takes if you have...\nBachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business, or related field, or equivalent relevant experience. 7+ years of experience in cybersecurity, compliance, risk, audit, cloud security, or public sector program management, including experience leading complex cross-functional programs. Demonstrated experience supporting a cloud service provider or SaaS organization in regulated public sector environments. Working knowledge of FedRAMP Moderate, NIST SP 800-53/53A, SSPs, SAPs, SARs, POA Ms, continuous monitoring, annual assessments, and 3PAO engagement.\nWorking knowledge of DoD cloud authorization concepts, IL4, DISA authorization processes, eMASS, STIGs, CUI handling, and authorizing-official or mission-owner engagement. Experience managing vulnerability remediation programs, SLA monitoring, exception/deviation requests, risk acceptance, corrective action plans, evidence validation, and executive escalation. Knowledge of Government of Canada Protected B security expectations, ITSG-33, cloud security controls, shared responsibility, and security assessment and authorization practices.\nExperience coordinating external audits, control-owner interviews, system demonstrations, evidence collection, remediation tracking, and government inquiries. Ability to satisfy personnel screening, residency, citizenship, background-check, and access-eligibility requirements applicable to assigned Canadian and U.S. public sector environments and contracts. Security and Citizenship Requirements Must be a Canadian citizen and be physically located in Canada .\nMust be eligible to obtain and maintain the Government of Canada security screening required for the role, including at minimum Reliability Status , through Public Services and Procurement Canada’s Contract Security Program (PSPC CSP). Must be eligible for appointment as Cornerstone’s Company Security Officer (CSO) and maintain security screening at the level required for Cornerstone’s organizational security clearance. Must be able to satisfy any additional Government of Canada personnel-security requirements applicable to Cornerstone’s federal contracts, including eligibility for a Secret security clearance where contractually required.\nAn extra dose of awesome if… Hands-on experience supporting both Government of Canada Protected B and U.S. federal or Department of Defense cloud programs. Experience working directly with Government of Canada departments, DISA, federal agency authorizing officials, mission owners, 3PAOs, or independent security assessors. Experience with AWS GovCloud, vulnerability scanning, SIEM, ticketing, GRC, and evidence-management platforms.\nPMP, PgMP, CISSP, CISM, CISA, CRISC, CCSP, CGEIT, or equivalent relevant certification. #LI-remote","description_format":"text","description_chars":8265,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Government","Learning Management Systems"],"lifecycle":[{"event":"open","at":"2026-11-03T23:03:54Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":25,"reasons":["conf:1","velocity","win:early","comp:brand"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/cornerstone-ondemand-senior-cybersecurity-program-manager","json_url":"https://alion.io/job/cornerstone-ondemand-senior-cybersecurity-program-manager.json","meta":{"generated_at":"2026-11-08T09:43:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21083,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6504},"rest":"https://alion.io/mcp/rest/get_company?id=6504"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcornerstone-ondemand-senior-cybersecurity-program-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcornerstone-ondemand-senior-cybersecurity-program-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcornerstone-ondemand-senior-cybersecurity-program-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cornerstone-ondemand-senior-cybersecurity-program-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcornerstone-ondemand-senior-cybersecurity-program-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3710686}},{"tool":"search_jobs","arguments":{"company":"cornerstoneondemand.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3710686},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}