Cybersecurity Manager Job Description

A cybersecurity manager owns the security program day to day: the team, the tool stack, the policies and the open list of risks that nobody has fixed yet. The CISA-hosted NICE Workforce Framework describes the closest work role, Systems Security Management, as responsible for managing the cybersecurity of a program, organization, system, or enclave. Its task list reads like a manager's calendar, from advising senior management on organizational cybersecurity efforts to performing cost/benefit analyses of cybersecurity programs, policies and systems.

Running the team

People come first. The manager hires and develops analysts, detection engineers, identity specialists and governance staff, decides who carries the pager, and settles which control areas each person owns. When a security team is thin, the manager decides what goes undone and makes sure leadership knows it. Contractors and managed security service providers may fill gaps in monitoring or penetration testing, and someone has to write their statements of work and hold them to it.

Incidents and escalation

When an alert turns into a real incident, the manager becomes the coordinator. That means confirming scope with the technical leads, bringing in legal counsel early, deciding when to call an outside forensics firm or the cyber insurer's breach panel, and keeping executives informed with facts rather than guesses. After recovery comes the postmortem: what failed, which control would have caught it, and what it will cost to close the gap.

Risk, compliance and audit

Audit evidence is a recurring part of the job. Auditors and examiners want proof that access reviews happened, that vulnerabilities were patched within policy, and that vendors were vetted before they touched production data. Depending on the employer, the manager may be working toward a SOC 2 report, an ISO/IEC 27001 certificate, PCI DSS compliance for payment data, HIPAA safeguards for health records, or a state rule such as New York's 23 NYCRR Part 500 for financial services firms. Frameworks such as the NIST Cybersecurity Framework give the program a shared vocabulary with auditors.

Reporting upward

The manager translates technical findings into decisions. A board does not need the count of blocked phishing emails; it needs to know which risks are rising, what the team recommends, and what that costs. Good reports pair each major risk with an owner, a deadline and a plain statement of what happens if it is accepted instead of fixed.

Where the role sits

Reporting lines vary. In a large company, a cybersecurity manager may report to a director of security or a CISO and lead one function, such as security operations, governance, or cloud security. In a mid-sized firm without a CISO, the same title can mean running the entire program and reporting to the CIO, the CFO or general counsel. The work blends technical judgment with budgeting, vendor management and a steady stream of conversations with people who control the systems but not the security priorities.

Education

A bachelor's degree in computer science, information systems, cybersecurity or a related field is the usual starting point, and BLS lists a bachelor's degree as the typical entry-level education for computer and information systems managers. BLS also notes that some employers require or prefer that candidates have a graduate degree. An MBA or a master's in cybersecurity management can help a manager who expects to own budgets and present to a board, but neither substitutes for years of hands-on work.

The path in

The Occupational Outlook Handbook says an IT security manager may need to have worked as an information security analyst before moving up. People can arrive from security operations, network or systems engineering, penetration testing, audit, or governance and compliance roles. As a rough guide, expect several years as a practitioner and some time leading a project or a small group of peers before a hiring manager trusts you with direct reports. Military and federal cyber backgrounds also lead into the role, and defense contractor positions may require a security clearance.

Certifications

• CISM, Certified Information Security Manager (ISACA). Aimed at program management rather than tooling. ISACA requires five or more years of information security management work experience across at least three of the four CISM domains, with waivers available for up to two years. You can take the exam before meeting the experience requirement, but you must apply for certification within five years of having passed it.
• CISSP, Certified Information Systems Security Professional (ISC2). A broad credential covering security domains from architecture to operations, with its own work-experience requirement.
• CISSP-ISSMP, Information Systems Security Management Professional (ISC2). An ISC2 concentration aimed at leaders who oversee incident response, governance and security program management.
• CRISC, Certified in Risk and Information Systems Control (ISACA). Useful for managers whose program leans toward governance and risk.
• CCSP, Certified Cloud Security Professional (ISC2). Relevant when the program is mostly cloud workloads.

Skills that separate good managers

• Writing risk statements an executive can act on in a single read.
• Building a budget case that ties a tool purchase or a new hire to a specific risk reduction.
• Running incident bridges calmly, with clear roles and a written timeline.
• Negotiating remediation dates with system owners who report elsewhere.
• Reading a control framework and knowing which requirements actually matter for this business.
• Enough technical fluency to review an architecture diagram, a detection rule or a cloud policy without deferring every question to the team.

BLS projects employment of computer and information systems managers, the occupation that includes IT security managers, to grow 16 percent from 2025 to 2035, much faster than the average for all occupations. It expects about 53,500 openings for the occupation each year on average over that decade. The May 2025 wage survey counted 670,570 people employed in the occupation nationally. BLS does not break out cybersecurity managers, so those figures describe the wider technology-management group.

Regulation is writing the job description

New York's Department of Financial Services amended its 23 NYCRR Part 500 cybersecurity regulation in 2023, with new requirements phased in from November 2023 through November 2025. The amended rule says the CISO of each covered entity shall report in writing at least annually to the senior governing body on the cybersecurity program. The final phase took effect on November 1, 2025, when covered entities were required to use multi-factor authentication for any individual accessing any of their information systems, with limited exceptions. For a manager at a DFS-regulated financial services company, those dates set hard deadlines for identity and access projects, and the CISO's annual written report gives the board a recurring look at the program and its open risks.

Federal incident reporting for critical infrastructure is still in rulemaking. The notice of proposed rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was issued in the Federal Register on April 4, 2024. A May 26, 2026 Federal Register notice scheduled town hall meetings to gather input on refining the scope and burden of that proposal. CISA's own guidance says CIRCIA's reporting requirements will not be effective until the final rule goes into effect, so managers at critical infrastructure organizations should track the docket and keep their incident playbooks ready to add a federal report.

Reading the job title

The title covers different jobs. At one company a cybersecurity manager may run a security operations center; at another, the role owns third-party risk and audit; at a third, the manager is the only security leader on staff. The NICE Workforce Framework files Systems Security Management under its Oversight and Governance category, and comparing that work role's task list with a posting is a quick way to see which version of the job is on offer. Whichever version it is, bring evidence of budget ownership, incident leadership and clear written reporting to the interview, along with examples of risks you persuaded a system owner to fix.

Where the career leads

From a manager seat, moves can include director of security operations, head of governance and risk, and CISO at a smaller organization. Some managers also move into security architecture or into consulting roles that run assessments for several clients. Managers who want the executive track should look for chances to own a budget line, present directly to a board committee, and lead a regulatory examination from start to finish.

Dear Hiring Committee,

I am applying for the Cybersecurity Manager position at Harborline Credit Union. For the past four years I have led security operations at Pinecrest Regional Bank, where I manage a team of analysts and engineers and report to our chief information officer on every major security risk.

When I took the role, our controls existed mostly on paper. Access reviews were late, our vulnerability backlog had no owners, and incident response depended on whoever happened to be on shift. I rebuilt the program around clear ownership. Each control area now has a named lead, every high-risk vulnerability carries a due date agreed with the system owner, and our incident playbooks have been tested in tabletop exercises with legal, communications and the executive team.

I also took over regulatory readiness. I prepared our evidence for two examinations and an external audit, rolled out multi-factor authentication to every employee and contractor, and moved our vendor reviews from a spreadsheet into a tracked workflow with renewal reminders. Our board now receives a quarterly risk report that I write in plain language: what changed, what we recommend, and what each choice costs.

I hold the CISM and CISSP, and I keep my technical skills current by reviewing detection rules and cloud configurations alongside my team. That keeps me honest when I ask engineers for an estimate or push back on a vendor's claims.

Harborline's growth into commercial lending will bring new systems, new partners and closer regulatory attention. I would welcome the chance to build a security program that keeps pace with that growth and gives your leadership a clear picture of risk at every step.

Thank you for your consideration. I look forward to talking with you.

Sincerely, Jordan Ellis