Manager, Security & Governance

About The Institutes

Located in beautiful Malvern Pennsylvania The Institutes are a not-for-profit comprised of diverse affiliates that educate elevate and connect people in the essential disciplines of risk management and insurance. Through products and services offered by our nearly 20 affiliated business units people and organizations are empowered to help those in need with a focus on understanding predicting and preventing losses to create a more resilient world.

Additionally we understand the importance of work-life balancein 2026 named us a Top Workplace for the eleventh year and USA Today named us a USA Top Workplace for the fourth year. We provide excellent benefits and a friendly team-focused work environment to drive employee engagement.

Manager Security & Governance

The Manager of Security & Governance will lead our security and governance program owning cybersecurity operations risk management compliance business continuity/disaster recovery (BCDR) third-party risk management (TPRM) and AI governance.

This role consolidates security accountability across cyber operations audit readiness security policy incident response and vendor risk governance including AI/third party risk analysis contractual data governance and vendor risk analytics.

The Manager Security & Governance will will work against NIST CSF 2.0 and drive The Institutes MDR partnership and security tool roadmap embed risk-tiered gates into our SDLC 2.0 process and own AI governance setting guardrails for agentic development and our citizen development program.

What Youll Do:

1. Own the enterprise security program aligned to the most current NIST CSF including maturity assessment remediation of unimplemented controls and continuous improvement of the Recover function.
2. Oversee daily cybersecurity operations including the MDR/agentic SOC relationship alert triage and escalation threat intelligence and vulnerability management with tracked remediation.
3. Manage the investigation of security breaches and incidents end to end ensuring complete incident response documentation after-action reviews and improvement actions.
4. Own the Third-Party Risk Management (TPRM) program end to end with full non-delegable accountability: maintain vendor tier classifications and risk profiles; review and distribute security questionnaires; collect and analyze SOC reports cyber insurance documentation and compliance artifacts; track vendor remediation items to closure; and proactively research vendor markets to surface emerging risks trends and current events.
5. Own AI and third-party risk analysis: conduct AI-focused vendor risk assessments covering model usage training data sources and data retention practices; maintain the AI risk scoring methodology; assess model risk exposure (bias explainability regulatory considerations); detect and mitigate Shadow AI usage across the organization; track vendor data exposure and data-sharing pathways; and operate TPRM/AI governance platform workflows (e.g. OneTrust).
6. Own contractual data governance risk review: evaluate AI/data-related clauses in vendor contracts - data ownership data residency model training rights sub-processor disclosures and AI indemnification and liability language - in partnership with General Counsel; strengthen AI and data protection contractual standards; and provide risk review during vendor onboarding and renewals coordinated by the Director Portfolio.
7. Provide vendor risk analytics and executive reporting: risk dashboards AI vendor exposure data risk trends model risk concentration and systemic risk patterns across vendor categories; assess overlapping AI tool capabilities and risk duplication in partnership with the Director Portfolio who owns cost and commercial rationalization.
8. Own the security tool portfolio strategy and consolidation roadmap (endpoint DSPM data protection backup/recovery SIEM MDR and Microsoft security stack) including lifecycle-forcing decisions such as on-premises end-of-life transitions.
9. Own BCDR: maintain test and continuously improve business continuity and disaster recovery plans including backup managed-service oversight and recovery validation.
10. Manage audits reviews and assessments of information systems on the schedule defined in the Information Security Policy; manage cross-functional teams through external audits and maintain compliance documentation and evidence; manage assessor independence ensuring assessment and remediation vendors are appropriately separated.
11. Develop implement and maintain security policies procedures and guidelines according to NIST best practices including the AI notetaker policy and applicable consent statutes.
12. Own AI governance operations: MCP allowlists coding-standard security requirements citizen developer guardrails app admin-consent review and the risk register for AI-enabled tools.
13. Develop and grow the Risk Steward capability within SDLC 2.0 staffing risk review at risk-tiered delivery gates in partnership with the engineering Directors.
14. Implement security awareness and training programs to educate employees about information security best practices.
15. Oversee the technical risk management process and prepare cybersecurity and third-party risk reporting for the Executive Committee and Board.
16. Perform employee evaluations and reviews for direct reports documenting as necessary.

What Were Looking For:

1. Bachelors degree in computer science information security or equivalent experience.
2. Minimum 8 years of information security experience including security operations and incident response.
3. Minimum 3 years leading a security or governance function or team.
4. Working knowledge of NIST CSF audit and compliance management BCDR and cloud security (AWS and Microsoft stack).
5. Demonstrated experience with third-party risk management including vendor risk assessment security questionnaire processes SOC report analysis and contract risk review; familiarity with TPRM/governance platforms (e.g. OneTrust) preferred.
6. Effective hands-on use of LLM-based tools to manage the research and analysis demands of the role.
7. Experience governing AI/ML or agentic technologies preferred; relevant certifications (e.g. CISSP CISM CRISC) preferred.

Key Competencies:

1. Risk Management and Governance
2. Third-Party and AI Risk Analysis
3. Decision Making
4. Leadership
5. Communication
6. Analytical Thinking
7. Relationship Building
8. Supplier and Partner Management
9. Enterprise Perspective
10. Technical Knowledge (Security Architecture and Operations)
11. Executive-Ready Reporting
12. Employee Development
13. Strive to reflect our five cultural values in all efforts: Put the Customer First Do What You Say Work Together Be Innovative and Do the Right Thing.

The Best Part The Benefits!

To enforce the importance of work-life balance employees enjoy excellent benefits including:

• 401(k) plan with company contribution up to 16%
• Generous time off package that includes paid vacation personal sick and holidays
• Paid maternity and parental leave
• Tuition reimbursement
• Medical dental vision and prescription coverage
• On our Malvern campus: Free lunch every day when working on campus onsite fitness center and a beautiful 1.25-mile walking path!

Required Experience:

Manager