Operational Security Manager

Job Summary

The Operational Security Manager provides operational and technical leadership for the delivery of cybersecurity services and security program execution across client organizations, with an emphasis on healthcare and other highly regulated environments.

This position is accountable for security service delivery, security resource management, operational risk reduction, vulnerability management governance, incident readiness, policy governance, security operational effectiveness, and the coordination of cybersecurity activities across internal resources, client stakeholders, managed service providers, and third-party partners.

The Operational Security Manager serves as the primary technical leader responsible for assigning security resources, establishing security priorities, coordinating security workstreams, and ensuring that cybersecurity initiatives align with organizational risk-management objectives. This role supervises security analysts and engineers and acts as the primary operational security liaison between client leadership, technical teams, governance stakeholders, and security service providers.

The Operational Security Manager is accountable for security operations oversight, security resource management, vulnerability management governance, incident response coordination, security service delivery, security program execution, security awareness programs, security risk coordination, policy and standards development, data protection governance support, technical stakeholder communications, and operational security reporting. The position is not accountable for project scheduling, milestone management, portfolio governance, or project-trackability reporting, which remain the responsibility of assigned Project Managers.

The Operational Security Manager partners closely with Project Management personnel, who maintain project schedules, milestones, dependencies, and portfolio reporting. While Project Managers own workstream trackability, the Operational Security Manager owns security resource assignments, technical execution oversight, service quality, and operational outcomes. Primary internal partnerships include Project Managers, Security Architects, GRC Analysts, Privacy and Compliance Teams, IT Infrastructure Leadership, Clinical Technology Teams, and Managed Security Service Providers.

Essential Job Functions

The following duties are normal for this position. The omission of specific statements of duties does not exclude them from being expected of this position if the work is similar, related, or a logical assignment for this position. Other duties may be required.

· Lead daily cybersecurity operations across assigned client environments, including monitoring, alert triage, incident response coordination, and operational remediation activities.

· Supervise security analysts, engineers, and specialized security resources; establish priorities and assign resources across security workstreams.

· Manage cybersecurity resource allocation across operational, strategic, and project-related activities, including workload balancing and resource-conflict resolution.

· Oversee the vulnerability and exposure management lifecycle, including scan review, risk prioritization, remediation coordination, exception management, executive reporting, recurring vulnerability review meetings, remediation validation, compensating-control validation, vulnerability trend monitoring, penetration testing coordination, and visibility into cloud, infrastructure, endpoint, application, IoT, and IoMT security exposures.

· Coordinate incident response activities, escalation processes, stakeholder communications, forensic investigations, third-party incident response services, post-incident reviews, corrective-action planning, incident response playbooks, escalation procedures, communication plans, lessons-learned updates, and tabletop exercises.

· Support governance, risk, and compliance activities, including assessments, audits, risk analysis, evidence collection, remediation planning, and policy, standard, procedure, and guideline development.

· Oversee managed security service delivery, service quality, operational effectiveness, service maturity, and accountability for assigned security tasks across internal and external resources.

· Coordinate data protection and privacy-related security activities, including DLP, DSPM, data classification, sensitive data protection, investigations, eDiscovery support, and remediation activities.

· Lead security awareness and training initiatives, evaluate program effectiveness, and develop recommendations to improve organizational security culture.

· Monitor third-party and vendor security risks, review material vendor-security findings, provide technical input to vendor risk assessments, and escalate issues that may affect operations or regulatory obligations.

· Provide operational security reporting to leadership and client stakeholders, including updates on security operations, vulnerability management, incident trends, control effectiveness, security-program maturity, and remediation activities.

· Provide technical status, resource constraints, and security-risk updates to Project Management for portfolio-level reporting while maintaining ownership of security-resource assignments, technical execution oversight, service quality, and operational outcomes.

· Lead threat intelligence and threat-informed defense activities, including evaluation of emerging threats, analysis of threat advisories, coordination with intelligence providers, and integration of threat intelligence into detection, response, vulnerability prioritization, and security operations.

· Oversee the operational effectiveness of security technologies and managed security platforms, including SIEM, EDR/XDR, vulnerability management, email security, identity security, logging infrastructure, and detection engineering.

· Participate in security architecture reviews and strategic technology initiatives to ensure operational security requirements, implementation considerations, and risk-management objectives inform enterprise technology decisions.

· Support cybersecurity-related business continuity and disaster recovery planning, testing, resilience assessments, recovery exercises, and corrective-action tracking.

· Develop, maintain, and report cybersecurity operational metrics, key risk indicators (KRIs), key performance indicators (KPIs), service-level measures, and security maturity metrics to evaluate program effectiveness and operational performance.

Knowledge & Skills

Special Skills & Knowledge

· Strong knowledge of cybersecurity operations, managed security services, incident response, vulnerability management, risk management, and security governance.

· Ability to coordinate complex security workstreams across client stakeholders, internal teams, managed service providers, vendors, and third-party partners.

· Ability to translate technical security findings into business-relevant risk statements, executive updates, remediation plans, and operational reporting.

· Working knowledge of healthcare cybersecurity, HIPAA Security Rule expectations, NIST CSF, security policies and standards, data protection concepts, and third-party risk oversight preferred.

Competencies

· Operational leadership and sound judgment in prioritizing cybersecurity work based on risk, urgency, client impact, and resource availability.

· Strong communication skills with the ability to engage technical teams, executive stakeholders, governance leaders, vendors, and third-party service providers.

· Demonstrated ability to coach, mentor, and manage security personnel while promoting collaboration, accountability, quality, and continuous improvement.

· Strong organizational, analytical, problem-solving, and escalation-management capabilities.

Requirements

Education & Experience

· 8+ years of cybersecurity experience.

· 3+ years managing security personnel.

· Healthcare experience preferred.

Required Certifications

· CISSP or CISM.

Preferred Certifications

· Cloud security certification, such as CCSP or AZ-500.

· Incident response certification, such as GCIH.

Supervisory Responsibility

· Supervises security analysts, security engineers, and specialized security subject matter experts as assigned.

· Provides coaching, work assignment, quality review, workload balancing, performance input, and professional-development support for assigned personnel.

Working Conditions & Travel Requirements

· Work is generally performed in an office or remote professional environment with frequent use of standard business and security operations technology.

· May require participation in incident-response activities, escalation calls, stakeholder meetings, and time-sensitive operational communications outside standard business hours as needed.

· Travel may be required based on client, operational, meeting, assessment, or incident-response needs.

Fortified Health Security is an Equal Opportunity Employer. In compliance with the Americans with Disabilities Act, Fortified Health Security will provide reasonable accommodations to qualified individuals with disabilities. If a reasonable accommodation is needed to perform this position, you need to inform Fortified Health Security People and Culture Team of such request. Signatures below indicate the receipt and review of this job description by the associate assigned to the position and the People and Culture Team.

Education & Experience

· 8+ years of cybersecurity experience.

· 3+ years managing security personnel.

· Healthcare experience preferred.

Required Certifications

· CISSP or CISM.

Preferred Certifications

· Cloud security certification, such as CCSP or AZ-500.

· Incident response certification, such as GCIH.

Supervisory Responsibility

· Supervises security analysts, security engineers, and specialized security subject matter experts as assigned.

· Provides coaching, work assignment, quality review, workload balancing, performance input, and professional-development support for assigned personnel.

Working Conditions & Travel Requirements

· Work is generally performed in an office or remote professional environment with frequent use of standard business and security operations technology.

· May require participation in incident-response activities, escalation calls, stakeholder meetings, and time-sensitive operational communications outside standard business hours as needed.

· Travel may be required based on client, operational, meeting, assessment, or incident-response needs.