Manager – IT Security

OUR TEAM: Promega’s IT Security team protects a global life sciences company with sites across North America, Europe, Asia Pacific and Latin America, a hybrid cloud and on premises environment, and research, manufacturing and quality systems that people depend on to do science. We are a small, senior team where everyone owns real scope and nobody is handed a narrow lane.

Right now we are building in two directions at once. We are standing up a formal certification program spanning ISO 27001, SOC 2 and regulatory requirements across the regions we operate in, and we are writing the governance model for enterprise AI as the company adopts it across every function. That second piece puts us ahead of most organizations our size, and it means the work is genuinely new rather than a repeat of what you have done before.
Promega is privately held and known for treating people well over the long term. Security here is supported and funded, not tolerated.

YOUR ROLE: You will lead Promega’s IT Security team and own how we protect the company’s people, data and systems worldwide. That means security operations and incident response day to day, and it means driving the longer programs that determine whether we are actually getting safer: vulnerability and remediation management, identity and zero trust, certification readiness, and the security of a rapidly expanding set of AI tools and employee built applications.

This is a hands on leadership role. You will coach and develop a team of experienced security professionals, and you will be close enough to the technical work to make real decisions rather than approve other people’s.

Just as important, you will build the relationships that make security work. Much of what we assess now originates outside IT, and your effectiveness will depend on people bringing you in while they are still deciding what to build rather than after. You will partner with teams across the business to understand what they are trying to accomplish and help them get there safely. You will be the person who explains risk clearly to leadership when a decision needs to be made, and the person the business trusts to say yes with conditions rather than simply no.

If you want a role where security is a growth program rather than a cost center, and where AI security is a current problem rather than a future one, this is that role.

JOB OBJECTIVE: Leads Promega's IT Security team in protecting the company's people, data, and systems across a global life sciences environment. Accountable for security operations, incident response, risk management, and compliance, while building a skilled, engaged and AI-enabled team that partners with the business to make security practical and easy to follow. Ensures the organization's growing use of AI is itself protected, safeguarding AI tool use and the data behind it and defending against emerging AI-driven attack vectors, while applying AI to strengthen threat detection and remediation across Promega's layered architecture. Sets direction for security practices that balance strong protection with business agility.

CORE DUTIES:

1. Leads, hires, coaches, and develops a team of security professionals, setting clear goals, providing regular feedback, and supporting career growth.

2. Owns the security operations program, including threat monitoring, vulnerability management, and timely remediation of risks across infrastructure, endpoints, cloud, and applications, applying AI capabilities to strengthen threat detection, proactive vulnerability discovery, and remediation. Accountable for remediation follow-through on identified findings, including penetration test results, audit findings, and vulnerability disclosures, with documented ownership and closure dates.

3. Directs incident response activities, maintains incident playbooks, leads post-incident reviews, and ensures lessons learned are applied.

4. Drives adoption of identity and zero trust principles, including access governance, privileged access controls, and multifactor authentication.

5. Maintains alignment with the NIST Cybersecurity Framework and applicable regulatory and certification requirements, including ISO 27001, SOC 2, NIS2, the EU Cyber Resilience Act, and UK Cyber Essentials, and ensures compliance evidence is continuously audit-ready.

6. Partners with IT teams and business leaders to embed secure-by-design practices into projects, vendor selections, and system changes, including environments handling regulated or GxP data.

7. Leads security assessment and governance of AI tools, model connectors, and citizen developer platforms, including risk rating, conditions of use, and ongoing review as capabilities change. Protects the data flowing through these tools while defending against emerging AI-specific attack vectors such as prompt injection, model manipulation, and AI-enabled social engineering.

8. Oversees the security awareness program, including phishing simulations and training, to strengthen a culture of shared responsibility.

9. Manages the security budget, tools, and vendor relationships, and reports on security posture, metrics, and risk to IT leadership.

10. Demonstrates inclusion through their own words and actions and is accountable for a safe workspace. Acts with kindness, curiosity and respect for others.

11. Embracing and being open to incorporating Promega’s 6 Emotional & Social Intelligence (ESI) core principles in daily work.

12. Understands and complies with ethical, legal and regulatory requirements applicable to our business.

KEY QUALIFICATIONS:

1. Bachelor's Degree or proven work experience that ensures you are ready to be successful in this role.

2. 10+ years of experience in information security or IT, including 1 to 3 years of people leadership experience.

3. Demonstrated experience leading security operations and incident response in an enterprise environment.

4. Working knowledge of AI security principles, including securing AI tool use and data, identifying AI-specific attack vectors, and applying AI capabilities to threat detection and remediation.

5. Working knowledge of security frameworks such as NIST CSF, and experience preparing for audits or compliance assessments.

6. Strong understanding of identity and access management, endpoint and cloud security (Microsoft Azure and Microsoft 365 preferred), and vulnerability management practices.

7. Ability to explain security risks clearly to technical and non-technical audiences and influence decisions across the organization.

8. Demonstrated proficiency in digital tools and technology, including Microsoft applications and mobile platforms, with the ability to adapt and leverage emerging technologies, such as artificial intelligence, to improve efficiency, automation, and collaboration.

PREFERRED QUALIFICATIONS:

1. Professional security certification such as CISSP, CISM, or equivalent.

2. Experience in life sciences, manufacturing, or other regulated industries, including GxP environments.

3. Experience with European cybersecurity regulations or global data privacy requirements.

PHYSICAL DEMANDS:

1. Ability to participate in an on-call rotation and respond to security incidents outside normal business hours when needed.

2. Ability to remain stationary for several hours at a time.

3. Ability to use a computer/Microsoft Office applications.

At Promega, we value diversity and strive to create an inclusive workplace. We are proud to be an Equal Opportunity Employer, making employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran status, disability, or any other protected class.