Program Manager, IT Cybersecurity
Analytics
Cyber Security
Cybersecurity Operations
Cybersecurity Tools
Data Platform
Data Security
Endpoint Security
Facilities Management
Incident Management
Incident Response
Information Security
Information Technology (IT)
InfoSec
Management
Nist Cybersecurity Framework
Nist Sp 800 171
NIST SP 800-53
Project Management
Risk Management
Security
Security Compliance
Security Information And Event Management
Security Monitoring
Security Operations
Security Operations Center
Security Standards
Security Standards And Frameworks
Splunk
Splunk Siem
Job Description
Aprio is seeking a Program Manager, IT Cybersecurity to lead the operational program for the Cybersecurity Operations team in a hybrid role in Raleigh, NC.
Responsibilities
- Own the SOC operating cadence, including on-call rotation, alert-quality review cycle, shift handoffs, and escalation paths; identify and resolve process drift early
- Coordinate live incidents by engaging the right stakeholders, recording decisions in real time, and assigning and tracking follow-up actions (technical decisions remain with the incident lead)
- Design, facilitate, and document quarterly tabletop exercises for the Operations team; support larger cross-functional exercises involving legal, IT, and business leaders
- Run structured post-incident reviews for significant incidents using severity levels defined in the incident response plan; ensure lessons feed into playbooks and the detection backlog
- Produce monthly and quarterly Operations reports for leadership, including metrics such as MTTR, alert volume, true-positive rate, on-call load, incident frequency, and audit findings for executive consumption
- Maintain the analyst training matrix mapped to the NICE Workforce Framework, track completion, and keep it current for workforce evidence in audits
- Own day-to-day vendor relationships with DFIR retainer firms, threat intelligence providers, and SIEM/EDR vendor account teams; manage SLA reviews and maintain renewal dates
- Provide Operations evidence to the GRC pod for client, vendor, and certification audits; map Operations activities to dependent controls
- Maintain the annual, quarterly, and monthly Operations program calendar covering tabletop dates, audit windows, vendor reviews, training cycles, and on-call planning
- Coordinate cross-functional handoffs with Detection Engineering, GRC, IT Service Management, and the Identity team
Requirements
- 3+ years in cybersecurity, IT GRC, or technical program management (or equivalent experience in a regulated industry with cybersecurity or GRC exposure)
- Working knowledge of how security operations teams operate: on-call rotations, alert-quality review, shift handoffs, and escalation paths
- Experience managing vendor relationships, ideally with DFIR retainer firms, threat intelligence providers, or security tooling vendors
- Strong written communication skills, including executive reports and post-incident review documents suitable for audit and client review
- Ability to coordinate people through incidents or other time-pressured situations without serving as the technical decision-maker
- Experience supporting audits by collecting evidence and mapping operational activities to control requirements
- Familiarity with at least one security or compliance framework at an operating-program level: NIST CSF, NIST 800-171/53, ISO 27001, SOC 2, HIPAA, PCI, CMMC, or similar
Technologies
- SIEM, EDR
- NICE Workforce Framework
- NIST CSF, NIST 800-171/53
- ISO 27001, SOC 2
- HIPAA, PCI, CMMC
- MTTR
Benefits
- Medical, Dental, and Vision Insurance on the first day of employment
- Flexible Spending Account and Dependent Care Account
- 401k with Profit Sharing
- 9+ holidays and discretionary time off structure
- Parental Leave with coverage for both primary and secondary caregivers
- Tuition Assistance Program and CPA support program with cash incentive upon completion
- Discretionary incentive compensation based on firm, group and individual performance
- Incentive compensation related to origination of new client sales
- Top rated wellness program
- Flexible working environment including remote and hybrid options
Preferred Qualifications
- Experience running tabletop exercises or post-incident reviews with mixed technical and business audiences
- Familiarity with the NICE Workforce Framework, especially mapping analyst training to NICE work roles
- One or more industry certifications: PMP, CISM, CRISC, GCPM, or ITIL
- Experience with SOC tooling from the program side, such as SIEM dashboards, case-management reporting, and on-call platforms
- Experience in a professional services or accounting firm
- Experience building program routines while a security operations team is growing
- Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field, or equivalent experience
Equal Opportunity Employer: Aprio is an Equal Opportunity Employer encouraging diversity in the workplace.
Location: Raleigh, NC (hybrid)
Salary: USD 145,000 - 160,000 per year
Similar Jobs
