Sr Information Security Manager

ABOUT MPG

Market Performance Group (MPG) is a leading end-to-end, strategy & services omnichannel commerce agency focused on creating the best PATH FORWARD — from market strategy to in-market reality — for today’s fastest-growing consumer packaged goods (CPG) manufacturers. Over the years, we’ve built a strong reputation as a trusted partner and valuable resource to a broad range of companies, from Fortune 500 to Private Equity, in categories that include health & wellness, food & beverage, home and hardlines. We revel in the opportunity to guide our clients on their path forward, building and activating strategies that ensure success. Everything we do is driven by our unrelenting commitment to leverage our deep operational experience, unparalleled omnichannel expertise, and industry relationships to drive performance in today’s dynamic omnichannel marketplace.

At MPG, we value our people and their contributions; they are critical to building the MPG Brand. Our leadership team has significant experience driving topline revenue and bottom-line profit, having held senior operating roles at leading CPG manufacturers and retailers. Our highly regarded, seasoned team of 400+ strategy and commercialization professionals brings strong operational experience and a collaborative approach. All team members are singularly focused on providing clients with pragmatic, real-world market approaches, built on the strong consumer, category and marketplace insights needed to create sustainable, profitable brand growth.

Position Overview

We are looking for an Information Security Manager to own MPG's information security and privacy program end to end: policy, training, incident response, risk, ISO 27001 and SOC 2 compliance, and the day-to-day security posture of the systems that hold company and client data. This role reports to the VP, Information Technology, and serves as the primary point of contact for senior management, clients, and auditors on security and privacy matters.

This is a hands-on role for someone who can set the policy and run the program — assessing risk, responding to incidents, and building the kind of security and privacy awareness that has to exist across the company, not just inside IT.

This is a security-focused role, not a broader IT management role: infrastructure, applications, and day-to-day IT operations stay with the VP, Information Technology and the rest of the IT organization. You own the security and privacy program; you partner with IT to get it implemented.

What You'll Do

• Security Program & Policy
• Assess people, processes, and technology across MPG to identify risk and vulnerabilities, and evaluate the effectiveness of the security and privacy program against changing laws, regulations, and industry trends.
• Implement the policies that make up a comprehensive information security and privacy program: security solutions, security and privacy training, incident response, audits, business continuity and disaster recovery, risk management, and change control.
• Manage the security solutions that protect MPG's applications, infrastructure, and networks, and ensure corporate networks, computers, and storage devices are monitored closely enough to catch attacks and respond to alerts quickly.
• Incident Response & Risk
• Run the incident management program: classify and mitigate incidents by risk level, manage the response, fix root causes so incidents do not recur, document everything formally, and communicate to internal stakeholders, clients, and government or local officials as required.
• Administer a risk management program to identify, classify, report, track, and mitigate risk, including a program to manage third-party security and privacy risk.
• Own the security and privacy dimensions of business continuity and disaster recovery planning — what has to be protected, restored, and communicated in a disruption — coordinating with IT infrastructure teams on execution.
• Review technical changes for security impact and maintain the change control standard that keeps changes secure, without owning the broader IT change process itself.

Training & Awareness

• Manage security and privacy awareness training programs and email phishing campaigns across the company.

Compliance & Audit

• Own MPG's ISO 27001 and SOC 2 compliance programs end to end: control ownership, evidence collection, audit prep, and remediation of findings.

• Serve as the primary point of contact for external auditors and certification bodies, and keep certifications current as MPG's environment and client requirements evolve.

• Ensure the information security and privacy function is held to, and maintains, the highest level of confidentiality.

Qualifications

Required

• 5+ years of IT experience, including 2+ years in an information security role.
• Excellent understanding of information security concepts, protocols, industry best practices, and strategies.
• Experience with common information security management frameworks, such as ISO 2700x, NIST 800-53, and COBIT.
• Experience running ISO 27001 and/or SOC 2 compliance programs, including owning controls and leading audits through to certification.
• Experience developing and maintaining security policies, procedures, standards, and guidelines.
• In-depth knowledge of information risk concepts and principles, and how to relate business needs to security controls.
• Experience with system technology security testing (vulnerability scanning and penetration testing).
• Proficiency in performing risk, business impact, control, and vulnerability assessments, and in defining treatment strategies.
• Excellent analytical and project management skills, with the ability to manage multiple projects concurrently.
• Excellent verbal, written, and interpersonal communication skills, including the ability to work across the IT organization, project and application teams, management, and staff.
• Knowledge and understanding of relevant data privacy and security laws and regulatory requirements.

Nice to Have

• Experience as an information security auditor, IT risk manager, or compliance analyst.
• A degree in cybersecurity or information technology, or equivalent work experience.
• One or more of: CISSP, CRISC, CDPSE, CISA, CISM, or GIAC.
• Familiarity with software development methodologies.

Compensation

The expected base salary range for this position is $90,000 - $150,000 annually, depending on experience, skills, and qualifications. In addition to base salary, this position may be eligible for performance-based bonuses and other compensation programs.

Benefits

MPG offers a generous package of health benefits, including medical, dental, vision, STD/LTD, paid maternity/paternity leave and life insurance. Our compensation program provides market industry base salary, bonuses, and 401K. In addition to paid holidays, we reward an employee’s extra efforts through unlimited paid time off.

Diversity and Inclusion

MPG provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

We are committed to ensuring that Diversity, Equity, Inclusion, and Belonging (DEI&B) are at the foundation of our culture. Through DEI&B, we embrace the beauty in all of the unique qualities of our employees, communities and clients. MPG’s DEI&B efforts empower us to collectively reach our full potential by fueling innovation, connection, and growth. We recognize the value of having a diverse and engaged team. We are an organization driven by PEOPLE. Our commitment to diversity, equity, inclusion, and belonging was born from our core values. We believe that by leveraging the unique perspectives and experiences of our employees, MPG can unlock more comprehensive, innovative, and long-standing results for both our client and retailer partners. As our journey continues to evolve, we have made intentional commitments to further champion DEI&B. The foundation of our pledge starts with our promise to each other, our clients, and the community.