IT Security Manager (455881)

IT Security Manager | 455881
DETAILS
Location: Fort Worth, TX 76117 (onsite 4-5 days per week)
Position Type: Direct-Hire
Hourly / Salary: to $160K + bonus structure

JOB SUMMARY
Vaco Technology is currently seeking a Security Manager for a Direct-Hire opportunity that is located in Fort Worth, TX 76117 (onsite 4-5 days per week).  The Security Manager is a newly created and pivotal role, where the manager will be developing and executing a comprehensive cybersecurity strategy to protect systems, data, and digital assets across a hybrid cloud (AWS) and OnPrem environment, supporting store operations, franchise partners, and guests. The Security Manager should come in with solid experience working alongside a strong CISO, with exposure to mature security practices and a clear grasp of what effective cybersecurity strategies look like, especially when it comes to moving the needle on NIST maturity levels. The Security Manager must be a hands-on security leader who knows how to balance strategy with execution, building strong policies, governance, and a resilient security posture, all while keeping budget realities in mind.  The Security Manager must be strong in Vendor Management, Process Improvement, and Agile Project Management and can lay out and communicate a clear plan for strengthening security across the board. Success in this role also means taking a non-tool-dependent approach, being comfortable wearing multiple hats, and stepping in to support both Security and broader IT functions.

• Lead the Development of Security Policies / Standards / Procedures – Advancing the NIST Maturity Level | NIST / PCI / DSS / GDPR Best Practices
• Manage Multiple Relationships with Multiple Security Vendors (Fortinet / Elementrix / Barracuda / OKTA / NOC/SOC Platform, etc.) / Potential MSP Vendors – Focusing on Consolidating Complex Vendor Landscapes / Optimizing Investments
• Navigate Hybrid IT Environment Transitioning from VMware VxRail-to-AWS utilizing Fortinet / Elementrix / Barracuda / OKTA, etc. | Prioritizing Policy Development Over Immediate Tool Optimization
• Oversee a Small Team – 1 Local Support Resource / 1 Network Engineer / 3^rd Party Helpdesk Team in Denver, CO (7-10 members / not fully dedicated)
• Coordinate Audits / Vulnerability Assessments / Remediation Efforts – Collaborating with IT / Business Stakeholders, Embedding Security Controls / Mentoring Team Members | Fostering Security-Aware Culture
• Deliver 30-60-90 Day Roadmap – Outlining Tactical Execution of Security Initiatives, Leveraging Agile to Prioritize / Manage Projects
• Address Identified Gaps in Recent Audits – Establishing Robust Governance Frameworks / SOPs, Ensuring Compliance / Consistency
• Strategically Lead / Align Security Initiatives with Business Objectives – Supporting Franchise Partners / Maintaining Guest Trust / Effectively Working within Budget Constraints / Achieving Maximum Impact

Complex Vendor Landscape: The current state of the vendor landscape is a disorganized and multifaceted ecosystem of multiple Vendors. Most of the Vendor relationships have been grown organically, added over time, without a true centralized strategy, ultimately leading to a fragmented and inefficient structure.  They have recently engaged an additional MSP to assist in supporting remediation efforts following recent audits, adding yet another layer to the vendor ecosystem.  The overall objective is for the Security Manager to consolidate the Vendor relationships, to identify and remediate any overlapping and/or redundant services, and to design standardization with effective integration.  This fragmented setup requires the Security Manager to have strong organizational and strategic skills to streamline vendor relationships, manage risks, and optimize investments.

• Fortinet (FortiManager / FortiAnalyzer) – Network Security
• Elementrix – Endpoint Telemetry
• SentinelOne – Endpoint Detection (to be phased out by the end of 2025)
• Barracuda – Emain Filtering
• OKTA – Identity Management
• NOC / SOC Platform (managed by a 3^rd Party Vendor)

JOB REQUIREMENTS

• IT Security Manager (5+ years) - Leading Security Programs / Projects / Teams | Vendor Management / Optimization / Consolidation
• Security Frameworks – Deep Understanding of NIST / CIS Controls / ISO 27001 | Compliance Requirements (PCI DSS / GDPR)
• Cloud Security – AWS / Azure (extensive / hands-on) | IAM / Cloud Security Controls / Monitoring
• On-Prem Security Infrastructure – Firewalls / IDS/IPS / Endpoint Protection (EDR) / Secure Network Architecture
• Security Operations – Leading Security Audits / Vulnerability Assessments / Pen Testing / Incident Response
• Enterprise Security – Building / Implementing / Managing Security Frameworks Across Hybrid (Cloud / On-Prem) Multi-Location Enterprise Environments
• Third-Party Risk / Vendor Management – Managing Third-Party Risk Assessment Programs / Vendor Management Processes
• Agile Project Management – Proficiency in Agile Methodologies / Sprint Planning / Iterative Delivery Processes
• Budget / Resource Management – Effective Budget Management / Resource Allocation for Security Initiatives
• Compliance Management (hands-on) – Managing Compliance with PCI DSS (QSR / Retail) / GDPR / SOX / HIPAA
• Agile / DevSecOps Environments – Integrating Security into Continuous Development / Operations Processes

Determining compensation for this role (and others) at Vaco/Highspring depends upon a wide array of factors including but not limited to the individual’s skill sets, experience and training, licensure and certifications, office location and other geographic considerations, as well as other business and organizational needs. With that said, as required by local law in geographies that require salary range disclosure, Vaco/Highspring notes the salary range for the role is noted in this job posting. The individual may also be eligible for discretionary bonuses, and can participate in medical, dental, and vision benefits as well as the company’s 401(k) retirement plan.