LaBella Associates

Architecture, engineering, environmental consulting, planning services

Security Compliance Program Manager

Security Governance, Risk & ComplianceConfirmed live in the last 24 hours

Full-timeRochester, NY, USA

About the Job

Requirements

A minimum of seven years of experience in security compliance or audit program management is required.
A bachelor's degree in Cybersecurity Management, technology compliance, or a related technology program management or auditing field is required; directly related work experience may be substituted for formal education.
A strong understanding of IT infrastructure, networking, security, and software development is required.
Preferred certification includes PMP, CISSP, a related auditor certification, or ISO document control certification.
The candidate must be able to foster teamwork and build collaborative relationships.
The candidate must be self-motivated to seek ways to aid and improve processes.
Strong communication and organizational skills are required.
The candidate must maintain confidentiality.
The candidate must be able to follow and relay complex oral and written instructions, policies, procedures, and technical information clearly and effectively to technical and non-technical audiences.

Responsibilities

Manage the ISMS committee, including scheduling meetings, providing agendas, keeping meeting minutes, and ensuring membership remains current and relevant.
Manage LaBella’s ISO 27001 and Information Security Management System program in cooperation with the Security Operations Manager.
Develop and maintain security policies, processes, and procedures in cooperation with Security, IT, and other department and division leaders.
Control ISO 27001 documents, including versioning, management reviews and approvals, employee communications, and maintenance of internal and external document-control websites.
Develop and maintain risk assessment and risk acceptance workflows and risk treatment and mitigation plans, and update the risk register with relevant department and division leaders and executive management at required intervals.
Develop communications and coordinate with executive, department, and division management; regional and office managers; internal and external communications managers; relevant third parties, including clients and vendors; and LaBella data owners.
Coordinate ISO audits with internal and external resources, and develop, track, and communicate corrective action plans.
Collect and maintain ISO 27001 and ISMS evidence and control documentation, and manage the governance, risk management, and compliance platform.
Establish and maintain an ISMS control ownership model, including control owners, control performers, approvers, review frequency, evidence requirements, and escalation paths for overdue or deficient controls.
Coordinate ISMS objectives, metrics, key performance indicators, and key risk indicators, and prepare recurring reports for the ISMS committee, executive leadership, Security, IT, Operations, and other relevant stakeholders.
Maintain an ISMS compliance calendar covering internal and external audits, management and policy reviews, risk assessments, access and supplier reviews, evidence-collection deadlines, training requirements, and certification milestones.
Coordinate with incident response, business continuity, disaster recovery, and crisis management stakeholders to ensure relevant plans, tests, lessons learned, and corrective actions are captured within the ISMS.
Promote continual improvement of the ISMS by identifying process gaps, control weaknesses, and opportunities to improve efficiency and consistency.
Coordinate with IT and Operations staff to ensure system performance and compliance with industry standards for physical and digital security systems, including surveillance cameras, access control systems, endpoint management systems, a 24/7 security operations center, and information security management software, as they relate to ISO 27001 certification.

Desired Qualifications

A PMP, CISSP, related auditor certification, or ISO document control certification is preferred.

Security Compliance Program Manager

LaBella Associates · Rochester, United States (Hybrid) · Full-time · Posted 2026-08-18

Salary: USD 90,000–110,000

Workplace: hybrid

Department: Operations

Description

We are currently looking to hire a Security Compliance Program Manager for LaBella's Operations Department. This position is located at our Rochester, NY office.

The primary responsibilities of this position are the program management, administration, and maintenance of LaBella’s ISO 27001 and Information Security System (ISMS) program.

Specific Duties/Responsibilities include but are not necessarily limited to the following:

Management of LaBella’s ISMS committee including scheduling, providing agendas, and keeping minutes of meetings, ensuring membership is maintained as current and relevant.
Management of LaBella’s ISO 27001 and Information Security Management System (ISMS) program, in cooperation with the Security Operations Manager, including but not limited to:
Security policy, process, and procedure development and maintenance, in cooperation with Security, IT, and other department and division leadership.
ISO 27001 document control, including versioning, management reviews and approvals, communication to employees, and updating/maintaining ISO 27001 document management sites including internal and external facing document control web-based sites.
Developing and maintaining risk assessment and risk acceptance workflow, risk treatment/mitigation plans, and updating LaBella’s risk register in coordination with relevant department and division leaders and executive management on required intervals.
Development of communication and coordination with executive, department, and division management, regional and office managers, internal and external communication managers, relevant third parties (clients, vendors, etc.), and LaBella data owners.
Coordinate ISO audits with internal and external resources and develop, track, and communicate corrective action plans
Collect and maintain ISO 27001/ ISMS evidence and control documentation, managing the GRC (Governance, Risk Management, and Compliance) platform
Establish and maintain an ISMS control ownership model, including assignment of control owners, control performers, approvers, review frequency, evidence requirements, and escalation paths for overdue or deficient controls.
Coordinate ISMS objectives, metrics, key performance indicators, and key risk indicators, and prepare recurring reporting for the ISMS committee, executive leadership, Security, IT, Operations, and other relevant stakeholders.
Maintain an ISMS compliance calendar covering internal audits, external audits, management reviews, policy reviews, risk assessments, access reviews, supplier reviews, evidence collection deadlines, training requirements, and certification milestones.
Coordinate with incident response, business continuity, disaster recovery, and crisis management stakeholders to ensure relevant plans, tests, lessons learned, and corrective actions are captured within the ISMS.
Promote continual improvement of the ISMS by identifying process gaps, control weaknesses, and opportunities to improve efficiency and consistency,
Coordinate with IT and Operations staff to ensure system performance and compliance with industry standards for physical and digital security items such as surveillance cameras, access control systems, endpoint management systems, 7x24 SOC, and information security management software as they relate to ISO 27001 certification.

Salary Range: $90,000 - $110,000 per year

The specific salary offered may be influenced by a variety of factors including but not limited to the candidate's relevant experience, education, and work location.

Requirements

Experience
Minimum of seven (7) years of experience in security compliance or audit program management.
Education
Bachelor’s degree in Cybersecurity Management, technology compliance, or a related technology program management or auditing field. Directly related work experience may be substituted for formal education.
Technical Expertise
Strong understanding of IT infrastructure, networking, security, and software development.
Industry Certifications
Preferred certification includes PMP, CISSP, related auditor or ISO document control certification.
Competencies
Proven ability to work in a team environment, to foster teamwork, and to build collaborative relationships.
Self-motivated to continuously seek ways to aid and improve processes.
Strong communication and organization skills.
An uncompromised ability to keep information confidential.
Ability to follow and relay complex oral and written instructions, policies, procedures, and technical information clearly and effectively to both technical and non-technical audiences.

Benefits

Body, mind, and wallet—LaBella’s benefits support a holistic approach to your health and wellness, creating the foundation for physical, mental, and financial well-being. Our benefit offerings cover the must-haves (healthcare and retirement), the just-in-cases (insurances and employee assistance programs), and the cherry-on-tops (fitness reimbursements, year-end incentive pay, and tuition assistance). Visit our website for more details on benefits listed below.

Flexible Work Schedule
Health/Dental Insurance
401k Plan with Employer Match
Paid Parental Leave
Short & Long Term Disability
Profit Sharing
Paid Time Off
Leadership Development Program
Fitness Reimbursement
Tuition Reimbursement
Referral Bonus Program
Wellness Program
Team Building Events
Community Service Events

LaBella is committed to facilitating a culture where diversity, equity, and inclusion are respected, valued, and celebrated by implementing thoughtful, practical, and innovative strategies that support our employees and serve the communities in which we reside. All applicants will be considered for employment without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender (including pregnancy, childbirth, breastfeeding or other related medical conditions), gender identity, gender expression, sexual orientation, marital status, veteran status, disability, genetic information, citizenship status, characteristic or membership in any other group protected by federal, state or local laws.

LaBella Associates does not accept unsolicited resumes from recruiting professionals or agencies, nor do we accept resumes from any source that does not reference a specific, open position. LaBella Associates will not be responsible for any fees arising from the use of resume submitted by recruiting professionals or agencies that do not have a current placement fee agreement with LaBella Associates. All initial communication with recruiting professionals or agencies must go through human resources.

Apply

Apply at LaBella Associates

About the Company

LaBella Associates

Architecture, engineering, environmental consulting, planning services

LaBella Associates provides architecture, engineering, environmental consulting, planning, and construction management for public and private infrastructure, buildings, energy, and community projects. It delivers integrated services—from planning and feasibility studies to design, environmental review, procurement, and construction oversight—through coordinated teams across its offices. The firm’s strength lies in its in-house, multi-disciplinary capabilities and national footprint, enabling single-source delivery and clearer communication for complex projects. Its goal is to help clients successfully complete infrastructure, energy, building, and community projects by guiding them from concept through construction with comprehensive planning and management.

Company size: 1,001-5,000
Company stage: Not listed
Total funding: Not listed
Headquarters: Rochester, NY
Founded: 1978

Recently Posted Jobs

Explore more opportunities at LaBella Associates

See more jobs