IT Security Program Manager

Job Title: IT Security Program Manager

Location: Boston, MA

Role Descriptions: Key Duties & Responsibilities

Program Planning & Tracking

• Own and maintain the master program plan across all four active security workstreams: NAA remediation (RC4-dependent and non-RC4-dependent phases), software download restrictions, vulnerability remediation, and USB data transfer controls.

• Maintain the program Gantt chart, ensuring task owners, dependencies, milestones, and target dates are accurate and up to date at all times.

• Track progress against key milestones, including the RC4 pilot test (May 2026), allow/deny list activation (June 2026), service account demand intake launch (May 2026), system owner engagement completion (July 2026), and full Phase 2 completion (Q3–Q4 2026).

• Identify and manage task dependencies across workstreams, site partners, InfoSec, Active Directory teams, ServiceNow, and external vendors (BeyondTrust, CrowdStrike, Waters, and others).

• Maintain a live risk and issue log, escalating blockers to Josh Bishop and Stu Miller in a timely and structured manner.

Agile Pod Coordination

• Facilitate regular sprint planning, stand-ups, and retrospectives for the agile pod of five OT Security Engineers, ensuring the team is unblocked, well-directed, and delivering against program priorities.

• Manage the team’s work backlog, prioritizing items in alignment with program milestones and stakeholder commitments.

• Coordinate workload distribution across site partners (Rashie Athukorala — LC1, Mike Cook — MFSD, Chris Thorley — Oxford/UK) to ensure coverage is balanced and site-specific dependencies are tracked.

• Work closely with the Business Analyst to align stakeholder engagement timelines with engineering execution timelines, ensuring field discoveries feed back into the program plan in real time.

Stakeholder Reporting & Communications

• Prepare and deliver regular program status updates to the Head of Lab Solutions, Program Manager, and Stu Director, Lab Systems.

• Produce clear, concise reporting packs for leadership audiences, including workstream RAG status, milestone progress, open risks, and upcoming decision points.

• Maintain the Lab & OT Security Confluence page content, ensuring workstream status, milestone dates, and team information remain current.

• Support Josh Bishop in preparing for leadership reviews with CISO and CIDO sponsors, providing structured input on program health and delivery confidence.

Dependency & Vendor Coordination

• Track and manage external dependencies with InfoSec, Active Directory teams, ServiceNow, and technology vendors, including BeyondTrust and CrowdStrike.

• Coordinate vendor engagement scheduling across sites, ensuring vendor access approvals, named-allow confirmations, and engagement records are tracked and current.

• Monitor the service account demand intake pipeline once activated, ensuring requests are triaged and actioned within agreed timelines.

Change & Hypercare Management

• Plan and coordinate hypercare periods following major program milestones (post-RC4 rollout, post-allow/deny activation, and post-Phase 2 completion), ensuring the team is staffed and response processes are documented.

• Track and close out hypercare findings, ensuring issues identified during stabilization periods are logged, owned, and resolved within agreed timescales.

• Maintain a lessons-learned log across all workstreams, contributing to continuous improvement in how the Lab Solutions team plans and delivers change.

Required Education Level

Bachelor’s degree required (B.S. in Business, Information Systems, Engineering, or a related field, or equivalent practical experience). PMP, PRINCE2, or equivalent project management certification preferred.

Required Experience

• 3–6 years of relevant project or program management experience, preferably within technology, IT security, or a regulated life sciences environment.

• Demonstrated experience managing concurrent workstreams with multiple owners, dependencies, and stakeholders in a complex organizational environment.

• Experience working with or coordinating agile delivery teams, including facilitation of sprint ceremonies.

• Proven track record of producing clear, structured program reporting for senior and executive audiences.

• Experience managing vendor relationships and external dependencies as part of a delivery program.

• Prior experience in a pharmaceutical, biotech, or similarly regulated industry is strongly preferred.

Required Knowledge / Skills

Program & Project Management

• Strong command of program planning tools and techniques — Gantt charts, risk logs, RAID registers, dependency mapping, and milestone tracking.

• Proficiency in project management tooling such as Jira, Microsoft Project, Smartsheet, or equivalent.

• Familiarity with both agile (Scrum/Kanban) and traditional waterfall delivery approaches, and the ability to blend them as the program requires.

• PMP, CAPM, PRINCE2, or SAFe certification is a plus.

Communication & Stakeholder Management

• Excellent written and verbal communication skills — able to produce crisp, accurate status reports and present program health clearly to senior leadership.

• Strong meeting facilitation skills, including the ability to run structured stand-ups, planning sessions, and risk reviews with distributed teams across time zones.

• Able to build credibility quickly with both technical engineers and non-technical business stakeholders.

Tools & Platforms

• Confluence or equivalent wiki platform for maintaining living program documentation and stakeholder-facing content.

• ServiceNow or equivalent ITSM platform for demand tracking and change management.

• Microsoft Office Suite (Excel, PowerPoint, Word) for reporting, Gantt management, and communications.

• Familiarity with security or IT operations tooling (CrowdStrike, BeyondTrust, Active Directory) is not required but is a meaningful advantage.

Working Style

• Highly organized with a strong bias for structure and clarity — comfortable creating order in ambiguous, fast-moving programs.

• Proactive and anticipatory — surfaces risks and dependencies before they become issues, not after.

• Collaborative and low-ego — effective influence without authority is essential in this role, as the PM coordinates across teams who do not report to them.

• Resilient and adaptable — able to replan quickly when priorities shift, new findings emerge, or external dependencies slip.

Other Requirements

• Ability to coordinate across global, multi-site teams, including US East Coast (Boston), US West Coast (San Diego), and UK (Oxford).

• Comfortable operating across multiple time zones to support distributed team stand-ups and stakeholder check-ins.

• Willingness to participate in or support hypercare periods following major program milestones.

Desirable Skills

Keyword: IT Service Management Consulting

Experience Required: 4–6 years