Information Security Manager ONI

Responsibilities include, but are not limited to, the following:

Security Governance, Risk and Compliance

• Operate and mature the enterprise security program in partnership with the Director of IT, aligning security investments and projects to identified risks and business requirements.
• Direct recurring risk assessments and control audits across ONI and its affiliate companies; maintain the enterprise risk register and drive remediation items to closure.
• Develop, maintain, and socialize security policies, standards, and procedures, mapping controls to a recognized framework (NIST 800-53, NIST SP 800-171, and or CMMC) and keeping documentation audit-ready.
• Own responses to customer security questionnaires, cyber insurance applications and attestations, and contractual or regulatory security obligations (e.g., CMMC, customer-specific requirements).
• Assist resource owners and IT staff at affiliate companies in understanding and remediating security audit findings reported by internal and external auditors.

Threat Detection, Incident Response and Security Operations

• Manage high-severity incident response end to end, including triage, containment, forensic analysis, executive communication, and post-incident review.
• Maintain and regularly test the incident response plan and supporting playbooks; coordinate tabletop exercises with IT and business leadership.
• Direct the operational management of vulnerability management, SIEM and managed detection and response services, threat intelligence platforms, and dark web monitoring.
• Manage MSSP and security vendor performance against service levels, escalating and remediating gaps in coverage or responsiveness.

Security Architecture and Technology

• Ensure consistent application of security standards and provide configuration guidance and change control for firewall, asset management, endpoint, and backup and recovery systems.
• Strengthen identity and cloud security across the Microsoft estate, including Active Directory and Entra ID, Conditional Access, privileged access management, Microsoft Defender, Intune, and overall Microsoft 365 and SaaS security posture.
• Partner with plant and operations leadership to extend asset visibility, network segmentation, and monitoring into OT/ICS and manufacturing environments, accounting for the availability and safety constraints unique to plant-floor systems.
• Evaluate, pilot, and recommend new security technologies, and lead their implementation across ONI and affiliate environments.

Data Protection and Emerging Technology Governance

• Lead data classification, data loss prevention, and insider risk initiatives, prioritizing protection of the company's most sensitive business and customer information.
• Establish and maintain governance for artificial intelligence and other emerging technologies, including acceptable use standards, data handling requirements, vendor and model review, and monitoring for unsanctioned tool usage.

Third-Party and Vendor Risk

• Oversee third-party risk assessments, including vendor due diligence, security and privacy terms in contracts, and ongoing monitoring of critical suppliers and service providers.
• Maintain an inventory of third parties with access to ONI systems or data, along with the assessed risk associated with each.

Leadership, Awareness and Reporting

• Supervise the Cybersecurity Engineer and other assigned security staff — setting objectives, guiding performance, and supporting professional development.
• Manage the delivery and measure the effectiveness of security awareness and training programs, including phishing simulation and role-based training.
• Lead the reporting and analysis of cybersecurity metrics and KPIs for both operational and executive audiences, including periodic updates to senior leadership.
• Lead cross-functional project teams, defining scope, schedule, and resource requirements, and delivering security projects on time and on budget.

Required Skills, Abilities and Education

• A minimum of five years of IT experience, including at least three years in a dedicated information security role and at least two years in a supervisory or team-lead capacity.
• Bachelor's degree or higher in Cybersecurity, Information Security, Information Systems, Engineering, Computer Science, or a related field of study. Equivalent experience combined with relevant certification will be considered.
• Demonstrated experience in risk assessment, incident management, and project management.
• Working knowledge of a recognized security framework (NIST 800-53, NIST SP 800-171, CMMC, CIS Controls, or ISO 27001) and experience mapping controls and evidence to it.
• Strong written and verbal communication skills, including the ability to translate technical risk into business terms for non-technical audiences.
• Hands-on familiarity with core security technologies, including SIEM, endpoint detection and response, vulnerability management, firewalls, email security, identity and access management, and backup and recovery.
• Experience securing a Microsoft enterprise environment, including Active Directory and Entra ID, Microsoft 365, Microsoft Defender, and Intune.
• Strong leadership skills and the ability to work effectively with business managers, IT engineering, and IT operations staff.
• Excellent analytical and problem-solving skills.
• The ability to interact with ONI and affiliate company personnel, build strong relationships at all levels and across all business units, and understand business imperatives.
• A desire to explore and learn new things.

Preferred Skills, Abilities and Education

• Industry certification such as CISSP, CISM, CRISC, GIAC, or Microsoft security certifications.
• Experience with tools in our technology stack such as Crowdstrike, Cloudflare, Microsoft Defender, Microsoft Entra ID, Security Scorecard, and others
• Experience in manufacturing, metals distribution, or other industrial environments, including exposure to OT/ICS security.
• Experience working within or partnering with large, complex, or decentralized multi-company organizations.
• Knowledge of and experience in developing and documenting security architecture and plans, including strategic, tactical, and project plans.
• An understanding of operating system internals and network protocols.
• Experience in application security testing (white box, black box, and code review).
• Experience in system security testing (vulnerability scanning and penetration testing).
• Experience managing MSSP or other outsourced security relationships.
• A strong customer focus, with the ability to manage expectations appropriately, provide a superior client experience, and build long-term relationships.