Security Awareness Lead

Smartsuite; Newport Beach (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Capitolis is seeking a Security Awareness Lead to own the security training program, including curricula, phishing simulations, and role-based content. You will tailor materials to high-risk roles, track completion, and provide metrics for audits and regulators.

Reporting to the Information Security Officer, you will collaborate with HR, policy, and communications to drive awareness and ensure evidence for SOC 2, ISO 27001, HIPAA and PCI DSS controls.

Qualifications

• Experience designing and delivering security awareness programs.
• Experience tailoring content for high-risk roles and regulatory requirements.
• Ability to evidence awareness controls for audits and certifications.

Responsibilities

• Design and deliver the security awareness and training program
• Run phishing simulations and targeted campaigns
• Track training completion and policy acknowledgements
• Measure behavior change and report awareness metrics
• Tailor content to high-risk roles and regulatory requirements
• Evidence awareness controls for audits and certifications

Job description

Governance, risk and compliance

SmartSuite for the Security Awareness Lead

The Security Awareness Lead runs the program that builds secure behavior: training curricula, phishing simulations, role-based content, policy acknowledgements and the metrics that show whether behavior is changing. They evidence awareness controls for auditors and regulators.

Reports to: Information Security Officer

What you own

The Security Awareness Lead runs the program that builds secure behavior: training curricula, phishing simulations, role-based content, policy acknowledgements and the metrics that show whether behavior is changing.

• Design and deliver the security awareness and training program
• Run phishing simulations and targeted campaigns
• Track training completion and policy acknowledgements
• Measure behavior change and report awareness metrics
• Tailor content to high-risk roles and regulatory requirements
• Evidence awareness controls for audits and certifications

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

• Compliance management
• Policy management
• Risk management
• Issues and actions
• Reporting

Touches

contributes or approves

Depends on

consumes its output

• Reporting

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Security Awareness Lead: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Information Security Officer

Direct reports

Works closely with

• HR Operations Manager
• Policy and Governance Manager
• IT Compliance Manager
• Communications Director

How SmartSuite supports the Security Awareness Lead

The Security Awareness Lead is accountable to the Information Security Officer, the CISO and auditors for showing that people were trained, acknowledged the policies and are changing their behavior. SmartSuite keeps completion data, attestations and follow‑up actions as evidence against the awareness control, so an audit request is a filter on the record rather than a search through exports.

Run the awareness program as a tracked control

Completion tied to the control it satisfies

Training completion is recorded against the awareness control with the attendee, the module and the date, through automated evidence collection rather than an export you tidy up. The control's status on the compliance dashboard reflects who has actually finished.

Stragglers chased by reminders, not by you

Publish a security policy, launch the acknowledgement campaign, let automated reminders chase the stragglers and watch completion by department on a dashboard. Review cycles re‑run the attestation when the policy changes, with the previous acknowledgements kept.

Role‑based content planned by risk

High‑risk roles are identified from the risk and control linkage in the security workspace, so targeted content for finance, privileged administrators or executives is planned against the threats they face rather than a generic annual module.

Work with HR, policy, compliance and communications

Repeat failures visible as a pattern

Phishing simulation failures are logged as issues by team, with follow‑up actions assigned and tracked to closure, so repeat failures show as a pattern and the manager of that team is in the loop through the record.

Policy changes that trigger your campaign

When the Policy and Governance Manager publishes a revision, the review and attestation workflow is triggered from the policy record, so your campaign and the policy version it covers are linked and the HR Operations Manager sees who is still to acknowledge.

Behavior and sentiment measured with surveys

Employee Engagement & Surveys and forms capture whether staff recognize the behaviors the program teaches, and the results sit beside completion and failure data. The Communications Director sees which messages landed and which need another push.

Give the CISO and auditors the evidence they ask for

Behavior trends, not just delivery counts

Completion, attestation, simulation failure rates and follow‑up status are tracked on real‑time dashboards by team and over time, so the report to the Information Security Officer and the CISO shows whether behavior is changing, not just whether training was delivered.

One control, many frameworks

The awareness control is mapped once and reused across SOC 2, ISO 27001, HIPAA and PCI DSS, so the same completion and attestation evidence answers each auditor without a separate collection for each certification.

Audit requests answered from the record

Full histories of training evidence, acknowledgements, campaign approvals and corrective actions are kept with granular permissions and activity logs, so an auditor's sample or a regulator's NYDFS or GLBA training question is answered from the system.

Compliance management. Tracks training completion and policy acknowledgements as evidence for awareness controls.

Policy management. Runs attestation campaigns for security policies with reminders and completion dashboards.

Issues and actions. Logs simulation failures and follow‑up actions by team.

Reporting. Reports awareness metrics and behavior trends to security leadership and auditors.

Products this role uses most

Policy Management

Centralize creation, approval, and publication of policies with full lifecycle tracking and attestations, ensuring they remain current, accessible, and auditable.

Compliance Assessments & Testing

Manage assessment campaigns and testing schedules with a reusable question library, automated workflows, and one place for evidence collection.

Employee Engagement & Surveys

Capture employee feedback, measure engagement, and drive improvement with surveys and real‑time insights.

Industry reference

NIST SP 800-50 Rev. 1 (2024) is the program guide; ISO/IEC 27001:2022 Annex A 6.3 requires awareness, education and training; the SANS maturity model benchmarks the program. Awareness is a tested control in SOC 2, PCI DSS v4.0.1 (Requirement 12.6) and ISO 27001 audits.

Regulators require it outright: the HIPAA Security Rule's security awareness and training standard, the GLBA Safeguards Rule's staff training requirement, NYDFS 23 NYCRR 500.14, FFIEC guidance for banks, annual security awareness training for US federal staff under FISMA, and NIS2's requirement that management bodies receive cybersecurity training.

Related roles

Information Security Officer

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Security Awareness Lead owns the program that builds secure behavior: the training curriculum and its delivery, phishing simulations and targeted campaigns, role-based content for high-risk roles, policy acknowledgements and the metrics that show whether behavior is changing. They also evidence awareness controls for auditors and regulators, which is a growing part of the job: SOC 2, PCI DSS, HIPAA, GLBA, NYDFS and NIS2 all treat awareness as a tested control, and the evidence has to be produced on demand.

SmartSuite tracks training completion and policy acknowledgements as evidence for awareness controls, so the record of who completed which training and when, and who acknowledged which policy, is held as compliance evidence rather than exported from a learning system when the auditor asks. Compliance Assessments & Testing holds the awareness control and its evidence, so the IT Compliance Manager can test it from the same record. The gap between the program and the audit disappears.

Policy Management runs attestation campaigns for security policies with reminders and completion dashboards, so when the acceptable use or information security policy is republished, every employee in scope is asked to attest, reminded until they do, and the Security Awareness Lead watches completion by team on a dashboard rather than in a spreadsheet of replies. The Policy and Governance Manager owns the policy text; the awareness lead owns the campaign that gets it read. Non-completion is visible by manager, which is what moves it.

SmartSuite logs simulation failures and follow-up actions by team, so a simulation's results become a record of which teams clicked, what follow-up was assigned and whether it was done, instead of a one-off report. The Security Awareness Lead can target the next campaign at the teams that need it and show the HR Operations Manager where repeated failures sit. Over several simulations the record shows whether behavior is changing, which is the question the program exists to answer.

SmartSuite reports awareness metrics and behavior trends to security leadership and auditors, so the report to the Information Security Officer or the Chief Information Security Officer shows completion, attestation and simulation trends over time, and the same view is what an auditor testing the awareness control under SOC 2 or ISO 27001 sees. Employee Engagement & Surveys can add the staff's own view of the program to the metrics. One set of records serves leadership, the regulator and the auditor.

The list of people in scope by team and role, the policies that require acknowledgement and the training completion records as they stand. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; the first workflow is the attestation campaign, and the evidence record builds from there. The training content itself stays wherever it is delivered; SmartSuite holds completion, acknowledgement, simulation results and the evidence. The Communications Director helps with the campaign messaging, and the HR Operations Manager supplies the joiners and leavers that keep scope accurate.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.