NIH - Lead Security Policy / Training Manager

cFocus Software seeks a Lead Security Policy / Training Manager to join our program supporting the National Institutes of Health (NIH). This position is fully remote. This position requires a Public Trust or the ability to obtain a public trust clearance.
Qualifications:

• Public Trust Clearance
• B.S. Computer Science, Information Technology, or a related field
• 10+ years of experience in information security, cybersecurity governance, compliance, or security program management.
• 5+ years leading enterprise security policy, governance, or awareness programs.
• Experience supporting Federal civilian agencies or other large enterprise organizations.
• Experience developing information security policies aligned with Federal cybersecurity requirements.
• Experience designing and managing enterprise cybersecurity awareness and training programs.
• Experience supporting executive-level governance initiatives.
• Preferred certifications: CISSP, CGRC, CISM, CRISC, GSLC, CIPM, CIPP/US, HCISPP, CPTM, CPTD, or PMP

Duties:

• Lead the development, review, revision, and maintenance of NIH/OD information security policies, standards, procedures, and governance documentation.
• Establish and maintain an enterprise Information Security Policy Management Strategy.
• Ensure policy documentation remains aligned with NIH, HHS, OMB, DHS, NIST, FISMA, Executive Orders, and other Federal cybersecurity requirements.
• Develop governance processes for policy lifecycle management, approval, publication, version control, and annual review.
• Maintain the inventory of all NIH/OD information security policies and supporting documentation.
• Coordinate policy reviews with Government stakeholders and technical subject matter experts.
• Monitor emerging Federal cybersecurity legislation, Executive Orders, OMB memoranda, NIST Special Publications, HHS directives, CISA guidance, and other regulatory requirements.
• Analyze the operational impact of new cybersecurity policies affecting NIH/OD.
• Identify compliance gaps and recommend implementation strategies.
• Prepare formal policy analysis reports for NIH leadership.
• Brief executive leadership on regulatory changes and implementation priorities.
• Support strategic planning for future policy adoption.
• Lead and manage the NIH/OD Information Security Awareness Program.
• Develop annual security awareness strategies and implementation plans.
• Design awareness campaigns addressing current cyber threats and user risks.
• Promote a culture of cybersecurity throughout the NIH organization.
• Measure program effectiveness through metrics and user participation.
• Develop continuous improvement initiatives for security awareness.
• Design, develop, coordinate, and oversee enterprise cybersecurity training programs.
• Develop role-based security training for technical and non-technical personnel.
• Coordinate instructor-led training sessions, webinars, workshops, and awareness events.
• Develop online learning content supporting NIH security objectives.
• Ensure mandatory cybersecurity awareness training meets Federal requirements.
• Evaluate training effectiveness through assessments and feedback.

Originally posted on Himalayas