Information Security Program Manager

Boston, Massachusetts
Ropes and Gray LLP

Job Posting Category Information Services

Ropes & Gray LLP is a preeminent global law firm focused on providing the highest-quality advice on our clients’ critical legal and business issues. Our global team of 2,500 talented professionals regularly helps clients meet high-stakes challenges, solve complex problems and achieve key goals. These colleagues work together across a global office network that includes offices in Boston, Chicago, Hong Kong, London, New York, San Francisco, Seoul, Shanghai, Silicon Valley, Tokyo, Los Angeles and Washington, D.C.

We are a contemporary firm that can bring more than 150 years of legal and institutional history to bear on the challenges clients face in today’s 24/7 global business environment. Our collaborative approach gives our clients-which include many of the world’s most respected companies and institutions-ready access to leading corporate, litigation, transactional and regulatory lawyers whose knowledge and experience span industries and geographies.

With an international presence, we focus on a number of key industries, including private equity; asset management; life sciences and health care; investment banking; technology, media and telecommunications; and consumer and retail. Our clients include global industry leaders, financial institutions, investment firms, private equity firms, hospitals and health care organizations, educational institutions, and individuals.

We have consistently been recognized for our leading practices in many areas, including private equity, M&A, finance, asset management, real estate, tax, antitrust, life sciences, health care, intellectual property, litigation & enforcement, privacy & cybersecurity, and business restructuring.

Ropes & Gray is an equal opportunity employer.

JOB SUMMARY:

Reporting to the Director of Information Security, the Information Security Program Manager is responsible for the ongoing management, development and execution of firm’s data security, compliance and risk management programs used to provide information security, ensure privacy and facilitate data governance.

As a leader within the Information Security Team, the Information Security Program Manager takes a central role in actively promoting a culture of information security throughout the organization.

The scope of this position is firm wide and requires a thorough understanding of all the IT systems the firm uses, and how those systems are secured.

ESSENTIAL FUNCTIONS:

• Proactively manage the firm’s ISO 27001:2013 Information Security Management System ensuring continual compliance and ongoing eligibility for annual recertification
• Coordinate and assist in tracking client inquiries to completion including but not limited to client audits, RFP requests, outside counsel guideline reviews, vulnerability impact queries, etc.
• Assist in planning, executing and delivering the firm’s security awareness training program.
• Assist in coordinating and executing on the firm’s third-party vendor risk management program.
• Assist in tracking and prioritizing vulnerability management and corresponding patch remediation efforts.
• Coordinate third party technical risk assessments and related audit and remediation activity.
• Produce and maintain information security documentation including, but not limited to policies, procedures, standards, guidelines and diagrams.
• Coordinate and execute on security project initiatives and identified remediation efforts.
• Assist in aligning information security resources, budgets, and strategic project initiatives to firm initiatives.
• Assist in the development and knowledge transfer to all junior team members, as well as other IT group members
• Promote a culture of information security across all business units
• Understand the role of systems and technology within the firm and the value they deliver to the business

OTHER RESPONSIBILITIES:

• Performs other work related duties as assigned

EDUCATION, EXPERIENCE AND SKILLS REQUIRED:

• Bachelor of Science in a technology related discipline or 3 years of relevant experience
• 5-7 years of experience in dedicated information security risk management or governance role
• Experience in the legal industry preferred.
• Strong knowledge of ISO 27001:2013
• Strong knowledge of risk management frameworks including; ISO 27005, OCTAVE, NIST and COBIT 5
• Strong knowledge of the global data security regulatory environment
• Strong knowledge of technology risk management concepts and their application
• Strong written and oral communication skills
• Organized, responsive and highly thorough problem solver

ESSENTIAL CAPABILITIES:

• Ability to relate to non-technical users in user-friendly language
• Ability to manage multiple concurrent objectives or activities, and effectively make judgments in prioritizing and time allocation in a high-pressure environment
• Ability to gauge one’s strengths and limitations
• Ability to deal with changes and adapt to a changing environment
• Must demonstrate the ability to maintain strict confidentiality of the firm’s internal and personnel affairs
• Ability to work well with others, harness different skills and experience, and build a strong sense of team spirit
• Highly self-motivated and directed
• Ability to work in a multi-office environment and willingness to travel to other offices as required
• Ability to work effectively in a culturally and educationally diverse environment

WORKING CONDITIONS:

Normal office environment.

Incumbent is expected to work the hours necessary to fulfill the responsibilities of the position.

Periodic travel may be required.

The above is intended to describe the general content of and requirements for the performance of this job. It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.

Ro pes & Gray is proud to offer a comprehensive Total Rewards package to our business support team members. The firm also offers comprehensive health and well-being benefits, personal and professional development, career growth opportunities and a collegial and supportive culture. The anticipated pay range for this role is $133,500 – $201,000 w hich represents our good faith and reasonable estimate of the starting salary range at the time of posting. In addition, this role is eligible for a discretionary bonus based on performance. The actual offered rate for this position will be determined based on job-related, non-discriminatory factors, including qualifications and experience, geographic location, education, external market data and consideration of internal equity.