Edtech.com's Summary

Elsevier is hiring a Cyber Security Governance Program Manager to mature the governance function of its Information Security and Data Protection team, which leads the company's cybersecurity practice. The manager builds a policy- and standards-driven governance program, redesigns the security awareness training program, and supports compliance certifications, working with technology teams, product owners, and business stakeholders and reporting to the Director of Cybersecurity Governance & Compliance.

Highlights

Lead the design and implementation of a policy- and standards-driven cybersecurity governance program supported by governance, risk, and compliance (GRC) tooling.
Establish and mature a data governance and protection program across the full data lifecycle, including data classification, labeling, and handling requirements that prevent inappropriate data sharing.
Support cybersecurity compliance certifications and initiatives such as ISO, PCI, and HIPAA, and drive resolution of cybersecurity GRC risks and issues.
Produce metrics, KPIs, and executive-level reporting to support risk-based decision making.
Lead the redesign of security training, including role-based training for developers, administrators, and executives and new hire training, and run phishing simulations that drive targeted follow-up training.
Extensive experience in cybersecurity governance, risk, and compliance, including developing security policies, standards, and controls and operating GRC platforms.
Working knowledge of frameworks such as ISO 27001, HIPAA, PCI DSS, NIST 800-53, and FedRAMP, plus proven project management and analytical skills.
CISSP, CISM, CISA, CHP, CHSS, or SANS Security Awareness Professional certification preferred.
Hybrid role with a base pay range of $104,900 to $174,700 and eligibility for an annual incentive bonus.

Cyber Security Governance Program Manager Full Description

Cybersecurity Governance Program Manager

Location: Hybrid – Atlanta, GA; Philadelphia, PA; London, UK

Are you looking to work for a global organization whereby you can drive the Cyber Security governance policies and standards?

About the Team

Elsevier’s Information Security and Data Protection (ISDP) team leads the Company’s cybersecurity practice, safeguarding information assets, consumer data, and technology infrastructure, and fostering a security-aware culture across the organization. We partner with business and technology stakeholders to enable effective risk management and support business objectives.

About the Role

Reporting to the Director of Cybersecurity Governance & Compliance, this Program Manager role focuses on maturing Elsevier’s governance function. The position leads the development of a policy- and standards-driven governance program, defines and operationalizes the data lifecycle, leads the redesign of the security awareness training program (including role-based and new hire training and phishing simulations), and supports cybersecurity compliance certifications and related initiatives. The role partners closely with technology teams, product owners, and business stakeholders across the enterprise.

Key Responsibilities

Leading the design and implementation of a policy- and standards -driven cybersecurity governance program supported by GRC tooling
Establishing and mature a data governance and protection program across the full data lifecycle
Defining and enforce data classification, labeling, and handling requirements, including controls to prevent inappropriate data sharing
Establishing and maintaining enterprise security governance structures, roles, and accountability
Serving as a trusted advisor to business and technology stakeholders on governance, risk, and compliance matters
Driving identification, escalation, and resolution of cybersecurity GRC risks and issues
Supporting and maintain cybersecurity compliance certifications and initiatives (e.g., ISO, PCI, HIPAA)
Producing metrics, KPIs, and executive-level reporting to support risk-based decision making
Leading the redesign of the security training program, including role-based security training (e.g., for developers, administrators, executives, and other high-risk roles) and new hire security training
Designing executing and measuring phishing simulations and campaigns, using results to drive targeted follow-up training and reduce human risk

Qualifications

Extensive experience in cybersecurity governance, risk, and compliance programs
Proven experience developing and managing security policies, standards, processes, and controls
Experience building or maturing enterprise data governance and data protection programs
Working knowledge of security and compliance frameworks such as ISO 27001/27701, ISO 27017/27018, ISO 42001, HIPAA, PCI DSS, NIST 800-53/800-171, FedRAMP, GovRAMP, etc.
Experience implementing and operating GRC platforms and security programs
Experience designing, delivering, or modernizing security awareness and training programs, including role-based and new hire training, aligned to compliance requirements (e.g., ISO 27001, PCI DSS, HIPAA)
Experience planning and running phishing simulations and campaigns, and measuring program effectiveness through metrics such as completion, click, and reporting rates
Proven project management, analytical, and problem-solving skills

Preferred Certifications: CISSP, CISM, CISA, CHP, CHSS, SANS Security Awareness Professional (SSAP)

U.S. National Base Pay Range: $104,900 - $174,700. Geographic differentials may apply in some locations to better reflect local market rates.

This job is eligible for an annual incentive bonus.

Let me find your next job.

Thanks - you're signed up.

Cyber Security Governance Program Manager

Edtech.com's Summary

Cyber Security Governance Program Manager Full Description

Cybersecurity Analyst

Security Engineer II (Endpoint Security)

Information Security Engineer III - 531081

Field Office Information Systems Security Manager (ISSM)

Information Security Engineer - Identity Governance and Access Management