Senior Security Program Manager

The Senior Security Program Manager at Notabene is responsible for leading compliance initiatives, managing security tools, and optimizing monitoring systems. This role also involves vendor procurement processes, developing security policies, and driving security awareness within the organization while ensuring regulatory compliance with standards such as SOC2, ISO27001, and GDPR.

For the Senior Security Program Manager role at Notabene, candidates should have at least 5 years of experience in information security, with a minimum of 2 years in a related role. A deep understanding of security frameworks and regulations like SOC2, ISO27001, GDPR, and practical experience with security tools and monitoring systems are essential.

Key skills for a Senior Security Program Manager at Notabene include strong project management abilities, excellent communication skills, and stakeholder management. Candidates should also have a track record of implementing security programs, knowledge of cloud security, and familiarity with risk management or IT audits.

Notabene offers a wide array of benefits for its Senior Security Program Manager roles, including flexible remote work options, a generous $1000 work-from-home stipend, access to the necessary technology like a MacBook Pro, and unlimited paid time off. The company is committed to employee well-being and provides country-specific benefits managed through their employer-of-record.

No, experience in the blockchain industry is not a strict requirement for the Senior Security Program Manager position at Notabene. The company is open to considering a diverse range of candidates, including those returning to work after a gap or those seeking the next step in their career.

When answering this question, highlight specific projects you led related to SOC2 compliance. Discuss the methodologies you used, the challenges you faced, and how you overcame them. Showcase your understanding of the SOC2 framework and its relevance to organizational security.

To address this question, explain your approach to prioritization, such as conducting risk assessments or using frameworks like the CIA triad (confidentiality, integrity, availability). Share examples of how you communicate priorities to team members, ensuring alignment across functions.

Discuss your methodology for developing security policies, which should include understanding business objectives, engaging stakeholders, and regularly reviewing and updating policies to reflect changing risks and regulations. Emphasize your focus on creating a security culture.

Share your strategies for staying informed about the latest security trends, such as participating in workshops, attending conferences, and following reputable security blogs. Emphasize the importance of continuous learning in the rapidly changing landscape of cybersecurity.

For this question, outline the steps you take in a vulnerability assessment, including identifying assets, scanning for vulnerabilities, analyzing results, and developing a remediation plan. Highlight your experience with specific tools and collaboration with IT teams.

Discuss your experience designing and delivering security training programs that promote awareness of current threats, compliance requirements, and best practices. Share metrics or outcomes that showcase the effectiveness of these training initiatives.

Describe your incident response framework and the importance of swift communication during a security incident. Include steps such as containment, eradication, and recovery, and emphasize the need to document lessons learned for future preparedness.

Highlight your approach to vendor risk management, which should include assessing vendors’ security practices, conducting regular audits, and ensuring compliance with industry standards. Talk about how you coordinate with procurement and legal teams to ensure thorough vetting.

Share your vision for creating a security-first culture, such as implementing regular security awareness training, encouraging open communication about security issues, and rewarding employees for reporting potential vulnerabilities.

To answer this, explain how you assess security tools based on the company's specific needs, existing infrastructure, budgetary constraints, and industry standards. Discuss your process for gathering feedback from stakeholders and conducting trials before full implementation.