Security Program Lead — ISO, FedRAMP & Privacy

Cambium Assessment; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

Cambium Learning Group is seeking a Security Manager to own and mature our information security program, aligning with ISO, NIST, and privacy requirements. You will coordinate audits, manage risk assessments, and drive remediation with cross-functional teams.

The ideal candidate has 5+ years in information security, strong communication, and hands-on experience with GRC tools, security controls, and security governance for educational technology platforms.

Qualifications

• Bachelor's degree or higher in a information security related field.
• Minimum 5 years hands-on information security experience.
• Deep knowledge of security/privacy frameworks and standards.
• Knowledge of privacy laws (GDPR, COPPA, FERPA).
• Experience with GRC tools and audit processes.
• Excellent written and verbal communication.

Responsibilities

• Maintain conformance to security standards and ISO/GovRAMP/FedRAMP/NIST.
• Facilitate annual independent audits by third-party experts.
• Plan and manage multiple security improvement projects.
• Manage document control and compliance artifacts.
• Lead security awareness training programs.
• Support proposals with security/privacy information.
• Perform security risk assessments of software, services, and new tech.
• Manage and monitor a GRC tool for controls and conformance.
• Report security issues and metrics to senior management.
• Identify risks and drive improvements in security posture.
• Manage privacy risks including cookies and APIs; maintain policies.

Skills

Verbal and written communication

Security governance

Risk assessment

Project management

Education

Bachelor's degree in Information Security / Cybersecurity / CS / Eng

Security certifications (CISSP/GIAC/ISACA/AWS Security)

Tools

GRC tools

Job description

Cambium Learning Group is seeking a Security Manager to own and mature our information security program, aligning with ISO, NIST, and privacy requirements. You will coordinate audits, manage risk assessments, and drive remediation with cross-functional teams.

The ideal candidate has 5+ years in information security, strong communication, and hands-on experience with GRC tools, security controls, and security governance for educational technology platforms.