Manager, Information Security

The Manager of Information Security leads Jama Software’s Information Security function and is responsible for ensuring the company’s security work is both strategically sound and operationally well-managed. This role requires a leader who can understand security best practices, interpret technical security information, assess risk, and make informed recommendations while also driving day-to-day execution across areas such as vulnerability management, incident response, security reviews, policy governance, and compliance readiness. The person in this role is expected to operate with a high degree of autonomy: identifying what needs attention, prioritizing the work, coordinating with the right stakeholders, communicating clearly, escalating blockers, and ensuring commitments are followed through to completion. They serve as a trusted security partner to Product, Engineering, IT, Legal, customer-facing teams, and senior leadership, translating complex security issues into practical business guidance and helping Jama maintain a mature, responsive, and reliable security posture. 

What You'll Do: 

• Lead the Information Security function, ensuring security programs are strategically aligned with business needs and operationally managed with clear owners, priorities, timelines, and follow-through. 

• Own the day-to-day execution of core security programs, including vulnerability management, incident response, security risk assessment, policy governance, compliance readiness, and security reviews. 

• Maintain clear visibility into active security issues, open findings, remediation plans, accountable owners, target dates, risks, decisions, and next steps. 

• Lead timely security incident response, including initial triage, SIRT coordination, investigation, mitigation, stakeholder communication, documentation, and post-incident follow-up. 

• Drive follow-up on penetration tests, security assessments, audits, customer findings, and other security reviews by identifying material risks, assigning owners, tracking remediation, and escalating blockers. 

• Interpret technical security findings and translate them into clear risk assessments, recommendations, and action plans for technical and non-technical stakeholders. 

• Develop, maintain, and operationalize security policies, standards, procedures, and guidance to support compliance obligations, customer expectations, and business priorities. 

• Ensure security requests from internal stakeholders, customers, and auditors are acknowledged, triaged, routed, and closed in a timely and transparent manner. 

• Serve as a trusted security advisor to Product, Engineering, IT, Legal, customer-facing teams, and senior leadership. 

• Coordinate cross-functional initiatives that improve Jama’s security posture, reduce risk, and support compliance with SOC 2 Type II. 

• Develop and maintain the Information Security roadmap, reflecting the emerging threats, customer expectations, regulatory requirements, audit findings, business priorities, and operational maturity needs. 

• Support security awareness, training, and policy acknowledgement efforts in partnership with appropriate business owners. 

• Evaluate and recommend security tooling, process improvements, and automation that improve visibility, response time, risk management, and operational effectiveness. 

• Lead and develop members of the Information Security team through clear expectations, coaching, prioritization, feedback, and accountability. 

What You'll Bring: 

• 8+ years of experience in information security, including hands-on experience with security operations, risk management, incident response, vulnerability management, and compliance programs. 

• 2+ years of people management experience, including setting expectations, coaching team members, prioritizing work, and holding others accountable for follow-through. 

• Demonstrated experience owning or leading core security programs, such as vulnerability management, incident response, security risk assessment, policy governance, security reviews, and compliance readiness. 

• Strong understanding of security best practices, application/product security concepts, cloud security, network fundamentals, and risk-based decision-making. 

• Experience supporting SaaS products or hosted enterprise software environments, including partnership with Engineering, Product, IT, or infrastructure teams. 

• Working knowledge of SOC 2 Type II and related security/compliance frameworks. 

• Strong written and verbal communication skills, including the ability to provide timely stakeholder updates and concise executive-facing summaries. 

• Demonstrated ability to operate autonomously, manage competing priorities, close communication loops, and follow work through to completion without requiring close day-to-day direction. 

• Experience partnering cross-functionally with Legal, IT, Product, Engineering, customer-facing teams, auditors, and senior leadership on security matters. 

Nice to Have: 

• Experience with security automation, workflow improvement, or tooling that improves visibility, triage, remediation tracking, or reporting. 

• Relevant security certifications such as CISSP, CISM, CCSP, GIAC, or AWS Security Specialty