Sr Mgr, Information Security

The Senior Manager u2013 Information Security Risk & Compliance is a hands-on leader responsible for executing and operating the organizationu2019s information security risk and compliance programs. This role directly performs risk assessments, supports audits, manages GRC tooling, and works closely with technical teams to remediate control gaps. The role balances leadership responsibilities with day-to-day execution and technical depth. Key Responsibilities Hands-On Risk Management u2022 Perform and lead information security risk assessments across applications, infrastructure, cloud environments, and business processes. u2022 Maintain risk registers, document findings, assign remediation actions, and track closure. u2022 Conduct threat modeling and control gap analyses in collaboration with engineering and security teams. u2022 Perform and review third-party/vendor security risk assessments and questionnaires. Compliance & Audit Execution u2022 Directly manage compliance efforts for frameworks and regulations such as ISO 27001, SOC 2, PCI DSS, SOX, GDPR, or HIPAA (as applicable). u2022 Prepare audit evidence, coordinate walkthroughs, and respond to auditor and regulator requests. u2022 Execute control testing and validate control design and operating effectiveness. u2022 Track remediation plans and validate corrective actions. Policy, Standards & Controls u2022 Draft, update, and maintain information security policies, standards, and procedures. u2022 Map technical and administrative controls to compliance requirements and business risks. u2022 Work hands-on with system owners to design and implement security controls. GRC Tools & Metrics u2022 Administer and optimize GRC tools (e.g., Varonis, Lighbeam, Tenable, Auditboard etc). u2022 Build risk dashboards, compliance metrics, and executive-level reporting. u2022 Automate evidence collection and control monitoring where possible. Cross-Functional Collaboration u2022 Work closely with IT, Cloud, DevOps, Security Operations, Legal, Privacy, and Internal Audit teams. u2022 Provide actionable security guidance during system design, cloud migrations, and vendor onboarding. u2022 Act as a subject matter expert for security risk and compliance inquiries. Leadership & Mentorship u2022 Lead by example with direct execution while mentoring junior risk and compliance staff. u2022 Review work products, provide hands-on coaching, and ensure quality and consistency. u2022 Support hiring and onboarding of risk and compliance team members as needed. Required Qualifications u2022 Bacheloru2019s degree in Information Security, Computer Science, or related field. u2022 8u201312+ years of experience in information security, risk, compliance, or IT audit roles. u2022 Strong hands-on experience with risk assessments, audits, and control testing. u2022 Practical working knowledge of NIST CSF, ISO 27001/27002, SOC 2, and cloud security controls. u2022 Ability to independently manage multiple assessments and audits end-to-end. Preferred Certifications u2022 CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent. Key Skills & Competencies u2022 Deep technical understanding of security controls and risk mitigation u2022 Strong documentation and evidence management skills u2022 Ability to translate compliance requirements into technical actions u2022 Comfortable working in fast-paced, hands-on environments u2022 Strong problem-solving and attention to detail Job Summary Manage and coordinate a team of Security Managers and Engineers. Ensure tight rigor and control over Security Operations and Audit processes. Major Tasks, Responsibilities, and Key Accountabilities + Serves as an internal information security consultant to the organization. Effectively leads and or coordinates all internal dedicated security functions including but not limited to - patching, anti-virus, intrusion prevention, CERT response, log file monitoring, cross division security coordination, systems operational security testing, rule set analysis, threat detection and adaptation, as well as advent security related functions. + Initiates activities to create information security awareness within the organization. + Performs information security risk assessments, and acts as an internal auditor. Evaluates audit findings and drives remediation of identified control deficiencies. + Reviews all system-related security planning throughout the network and acts as a liaison to information systems. + Monitors compliance with information security policies and procedures, addressing problems with the appropriate department manager or data owner. + Oversees the security policy to ensure appropriateness. Provides training and consultation to ensure understanding of and compliance with established security standards and controls. Manages the Computer Security Incident Response Plan. + Manages the Risk Program including coordination and follow-up of the semi-annual risk assessment and development and implementation of business unit policies and standards. + Manages the business unit's audits and examinations. Works with management to put controls in place needed to comply with SOX and PCI regulatory requirements. Nature and Scope + Solutions require analysis and investigation. + Achieves planned results by decisions and actions based on professional methods, business principles, and practical experience. May recommend/make decisions regarding new programs/initiatives that have significant impact to the business and carry consequences in unsuccessful endeavors. + Manages a larger team or multiple small teams through direction of subordinate management and/or supervisory staff. Work Environment + Located in a comfortable indoor area. Any unpleasant conditions would be infrequent and not objectionable. + Most of the time is spent sitting in a comfortable position and there is frequent opportunity to move about. On rare occasions there may be a need to move or lift light articles. + Typically requires overnight travel less than 10% of the time. Education and Experience + Typically requires BS/BA in a related discipline. Generally 7+ years of experience in a related field. May require certification. Advanced degree may offset less experience in some disciplines. Our Goals for Diversity, Equity, and Inclusion We are committed to creating a culture that promotes equity, respect, and advocacy for every HD Supply associate. We value the diversity of our people. Equal Employment Opportunity HD Supply is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.HD Supply is an Equal Opportunity Minority/Female/Individuals with Disabilities/Protected Veteran and Affirmative Action Employer. HD Supply considers for employment and hires qualified candidates without regard to age, race, religion, color, sex, sexual orientation, gender, gender identity, national origin, ancestry, citizenship, protected veteran or disability status or any factor prohibited by law.

Created: 2026-01-15