Principal cybersecurity Program Manager

Position Overview

We are seeking a senior IT Security Program Manager to lead a multi-year, enterprise-wide cyber resilience program across a large, multi-billion-dollar enterprise. The program has one goal: when a significant cyber event occurs, delay it, shrink it, and shorten it. The outcome we care about most is protecting our customer relationships by keeping disruption to the services we deliver to them as small as possible.

This role reports to technology leadership and works closely with the CIO, CISO, and the leaders of our application and infrastructure portfolio. You will help the Enterprise Architect, Enterprise Risk Manager, CISO, and App/Infra Leader keep teams focused on building the key capabilities that reduce our risk, and on proving those capabilities through practice.

The role requires a rare combination of skills. You need the executive presence to brief and align senior leaders, including the CIO, CFO, Legal, Internal Audit, and Enterprise Risk. You also need the technical fluency to earn credibility with architects, engineers, and scrum teams and to remove their blockers.

Key Responsibilities

• Make sure each capability is not only built but proven through practice: recovery exercises, tabletop simulations, and measurable test results.
• Turn architecture, standards, and risk priorities into actionable roadmaps, epics, and sprint-level work.

• Work directly with technology leaders, their managers, and their scrum masters, along with architects and the CISO's teams, to plan and execute the work.
• Drive delivery cadence using Agile/Scrum and Lean practices without degrading core business operations or service reliability.
• Identify and remove blockers, and resolve cross-team dependencies.
• Adapt the plan as needs change and new discoveries arise, such as legacy systems, technical debt, or previously unknown exposures.

• Serve as the single operational point of accountability for program status, risks, and dependencies.
• Prepare and present Steering Committee updates to an audience that includes the CIO, CFO, and senior Legal, Internal Audit, and Enterprise Risk leaders.
• Maintain program dashboards, risk registers, milestone tracking, and budget and burn-rate reporting.
• Define and report metrics that show risk reduction, such as exposed-asset coverage, patch latency, segmentation progress, and recovery time demonstrated in exercises.
• Support program budget management (CapEx/OpEx) and the coordination of vendors and third-party delivery partners.

• Lead change management across business units so that new security controls, identity requirements, and recovery practices are adopted.
• Negotiate trade-offs between operational productivity and cyber resilience, always keeping customer service continuity as the priority.
• Turn lessons from incidents and exercises into lasting fixes rather than one-time remediations.

Required Qualifications

• Experience: 10+ years of technical program management or security leadership, including at least 5 years directing large-scale security initiatives at Fortune 100 or $10B+ revenue enterprises.
• Track record: Has led a comprehensive security overhaul, cyber resilience program, Zero Trust rollout, or legacy modernization involving distributed engineering teams.
• Executive communication: Has presented to and advised C-suite executives and operated within formal steering committees that include finance, legal, audit, and risk leadership.
• Agile delivery: Hands-on experience working with managers, scrum masters, and architects across multiple teams to plan and deliver complex technical work.
• Technical breadth: Strong working knowledge across:
  • Identity and Access Management (IAM / PAM / MFA)
  • External attack surface management, vulnerability management, and automated patching
  • Network segmentation and Zero Trust Network Access (ZTNA)
  • Security operations (24/7 SOC, EDR / XDR / SIEM / SOAR)
  • Backup and recovery: immutable backups, isolated recovery environments (cyber vaults), and disaster recovery testing
  • Cloud security (AWS, Azure, or Google Cloud Platform) and secure application standards
• Work arrangement: Based in the United States and able to work on-site 3 days per week.
• Education: Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or equivalent practical experience.

Preferred Qualifications

• CISSP, CISM, PgMP, or PMP certification
• Experience with cyber recovery or ransomware-resilience programs, including running live recovery exercises
• Familiarity with frameworks such as NIST CSF, CIS Controls, or ISO 27001
• Experience in environments with legacy or industrial IT/OT systems