Manager-Information Security

Buchanan Ingersoll & Rooney is a national law firm with a proven reputation for providing progressive, industry-leading legal, business, regulatory and government relations advice to our regional, national and international clients.

The Manager, Information Security, will join a dynamic security team that is responsible for continually improving the Firm’s security posture and will be focused on managing and improving its network, system, identity, and cloud security capabilities. Reporting to the Firm’s Director – IT Operations and Security, and collaborating with other IT teams and Firm leadership, the role will manage all aspects of security governance, risk, compliance, and operations.

• →Security governance, including policy, process, procedure, and standards.
• →Risk management, including threat intelligence, risk assessment, analysis, and mitigation planning.
• →Compliance management, including ISO 27001, PCI-DSS, and client assurance audit and questionnaires.
• →Resource management, including budget, vendor, and managed security service providers.
• →Security awareness and training, including liaising with and advising IT, Firm leadership, various departments and practice groups regarding emerging threats, policy, controls, and best practices.
• →Design and architecture review, including network, system, application, identity, collaboration, and cloud infrastructure.
• →Continual monitoring, testing, and audit lifecycle management, analysis, and remediation tracking.
• →Detection and response, including log aggregation, correlation, analysis, incident response, and recovery.
• →Oversight of security operational functions and technology, including firewall, network segmentation, vulnerability management, privileged / remote access management, EDR/NGAV, SIEM, email security and continuous monitoring.
• →Coordination, prioritization, and delivery of projects, administrative, and continual improvement initiatives.
• →Performs other work-related duties as assigned.

• Bachelor’s degree or equivalent with at least 5 years of security-related experience.
• 10+ years of experience working in an information technology related field.
• Strong IT Operational background and related network, systems, or development experience
• 3+ years of experience managing a team of technical security engineers.
• Strong knowledge of security threats involving systems, identities, and cloud services.
• Direct experience implementing and maintaining ISO 27001 and 27701.
• Working knowledge of aforementioned security technology.
• Understanding technical implications of risk and effectively communicate to non-technical users.
• Ability to manage concurrent activities, effectively prioritize, and adapt to a dynamic environment.
• Demonstratable ability to maintain strict confidentiality of the Firm's internal and personnel affairs.
• Ability to work well with others, leverage varying skills and experience, and build team comradery.
• Highly self-motivated, directed, and able to gauge one’s strengths and limitations.
• Ability to work in a multi-office environment and willingness to travel to other offices as required.
• The following certifications highly desired: CISSP, CISM, CEH, CIPP; matriculating candidates considered.
• Experience working in a law Firm or professional services Firm environment preferred.

Our Firm offers outstanding benefits that include:

• Hybrid work schedules
• Generous Paid Time Off
• Paid Holidays, including a floating holiday
• WorkWell wellness program
• Free use of building gym
• Caregiving assistance with Bright Horizons (child, elder, and pet care!)
• Access to our Firm-wide emergency assistance fund
• Free full access to LinkedIn Learning
• Insurance – Medical, Dental, Vision
• 401K Program
• Retirement Savings Program

We are an Equal Opportunity Employer.