Manager, IT Security

Nimble Solutions; Chesterfield; On-site; GBP 70,000 - 110,000; Full time

Job summary

nimble solutions is seeking a seasoned Manager, IT Security to lead day-to-day security operations and engineering across cross-border teams, partnering with MSSP and internal stakeholders.

You will own identity/access management, incident response, and audit support including SOC 2 Type II and HIPAA compliance, shaping security culture and resilience.

Qualifications

• 10+ years in information security operations or engineering.
• 2+ years in a people-management or team-lead capacity.
• Hands-on experience with the Microsoft security stack – Defender for Endpoint, Sentinel, Purview, Intune, Entra ID.
• Experience supporting SOC 2 Type II and/or HIPAA compliance programs (evidence gathering, control testing, auditor engagement).
• Experience managing or closely partnering with a managed security services provider (MSSP) / outsourced SOC
• Experience building or maturing an incident response program, including playbooks and tabletop exercises.
• Comfortable managing distributed, cross-border teams (US and India).
• Strong written and verbal communication skills, with the ability to translate technical risk into business terms for non-technical stakeholders.

Responsibilities

• Own day-to-day security tooling and operations: EDR/XDR, SIEM, DLP, device compliance, and Conditional Access / Zero Trust controls.
• Lead the Daily Security Huddle and weekly Vulnerability Management meetings; drive remediation to SLA.
• Own the identity and access management program: MFA, Conditional Access, privileged access management, RBAC, joiner/mover/leaver automation.
• Serve as the primary internal point of contact for the MSSP on SOC alert triage, escalation, and remediation follow-through.
• Maintain and continuously improve the incident response playbook and runbooks, aligning with MSSP processes.
• Coordinate tabletop exercises and post-incident reviews; act as security escalation point for active incidents.
• Support annual SOC 2 Type II audit cycle – evidence collection, control walkthroughs, auditor liaison.
• Maintain NIST CSF control documentation and contribute to risk-remediation efforts.
• Support HIPAA/PHI security controls and periodic risk assessments; coordinate third-party penetration testing and remediation.
• Directly manage the security engineering/operations team spanning US and India.
• Own performance management, coaching, and succession planning within the team.
• Partner with Infrastructure, Workplace Services, and Development leadership on cross-functional security initiatives.

Skills

Security operations

Team leadership

SOC 2 Type II

HIPAA compliance

MSSP collaboration

Incident response

Written communication

Cross-border teamwork

Risk assessment

Cybersecurity governance

Tools

Defender for Endpoint

Sentinel

Purview

Intune

Entra ID

Job description

Job Type

Full-time

Description

Why work at nimble?

This is a great opportunity to join a well-established and market-leading brand serving a high-growth end market while gaining valuable experience working closely with Executive leadership. As an organization, we are in high-growth mode through acquisition with a laser focus on positive culture building!

Who we are!

nimble solutions is a leading provider of revenue cycle management solutions for ambulatory surgery centers (ASCs), surgical clinics, surgical hospitals, and anesthesia groups. Our tech-enabled solutions allow surgical organizations to streamline their revenue cycle processes, reduce administrative burden, and improve financial outcomes. Join over 1,100 surgical organizations that trust nimble solutions and its advisors to bring deep insights and actionable intelligence to maximize their revenue cycle.

The Manager, IT Security leads day-to-day security operations and engineering for the company: coordinating with our managed security services provider (MSSP) on SOC alerting and response, driving vulnerability and identity/access management programs, maintaining incident response readiness, and supporting our SOC 2 Type II, HIPAA, and NIST CSF compliance programs. This person manages a small cross-border team of security practitioners and is the operational backbone of the security function as the broader organization builds out, including future Director and GRC leadership roles.

On a typical day, you'll be responsible for:

• Own day-to-day security tooling and operations: EDR/XDR, SIEM, data-loss prevention, device compliance, and Conditional Access / Zero Trust controls across the Microsoft security stack (Defender for Endpoint, Sentinel, Purview, Intune, Entra ID)
• Lead the Daily Security Huddle and weekly Vulnerability Management meeting; drive vulnerability remediation to closure against defined SLAs
• Own the identity and access management program: MFA, Conditional Access, privileged access management, RBAC, and joiner/mover/leaver automation
• Serve as the primary internal point of contact for the managed security services provider (MSSP/vCISO) on SOC alert triage, escalation, and remediation follow-through
• Maintain and continuously improve the incident response playbook and runbooks, aligning internal procedures with the MSSP's SOC processes and pre-defined escalation thresholds
• Coordinate tabletop exercises and post-incident reviews, and act as a security escalation point for active incidents
• Support the annual SOC 2 Type II audit cycle – evidence collection, control walkthroughs, and auditor liaison – in partnership with the compliance/GRC function
• Maintain NIST CSF control documentation and contribute to ongoing risk-remediation (POA&M) efforts
• Support HIPAA/PHI security controls and periodic risk assessments; coordinate annual third-party penetration testing and remediation
• Directly manage the security engineering/operations team, spanning U.S. and India-based staff
• Own performance management, coaching, and bench-strength / succession planning within the team
• Partner closely with Infrastructure, Workplace Services (help desk/IAM), and Development leadership on cross-functional security initiatives

Requirements

Who you are:

• 10+ years in information security operations or engineering, including 2+ years in a people-management or team-lead capacity
• Hands-on experience with the Microsoft security stack – Defender for Endpoint, Sentinel, Purview, Intune, Entra ID (Conditional Access, MFA, PIM)
• Experience supporting SOC 2 Type II and/or HIPAA compliance programs (evidence gathering, control testing, auditor engagement)
• Experience managing or closely partnering with a managed security services provider (MSSP) / outsourced SOC
• Experience building or maturing an incident response program, including playbooks and tabletop exercises
• Comfortable managing distributed, cross-border teams (U.S. and India)
• Strong written and verbal communication skills, with the ability to translate technical risk into business terms for non-technical stakeholders