Information Security Manager
Information security managers are responsible for the cybersecurity of a program, organization, system, or enclave. The work covers advising senior management on risk levels and security posture, overseeing security training and awareness, and making sure remediation plans are in place for vulnerabilities found in risk assessments, audits, and inspections.
Related job titles
- Information systems security manager
- Information systems security officer (ISSO)
- Information assurance security manager
- Cybersecurity officer
- Enterprise security officer
- Cybersecurity manager
What They Do
12 tasks- Advise senior management, such as the chief information officer, on risk levels and security posture.
- Acquire and manage the leadership support, financial resources, and key security personnel needed to meet IT security goals and reduce overall organizational risk.
- Oversee the information security training and awareness program.
- Manage the monitoring of information security data sources to maintain situational awareness across the organization.
- Supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.
- Make sure plans of action and milestones or remediation plans are in place for vulnerabilities found in risk assessments, audits, and inspections.
- Track audit findings and recommendations so that appropriate mitigation actions are taken.
- Prepare, distribute, and maintain plans, guidance, and standard operating procedures for the security of network system operations.
- Continuously validate the organization against policies, guidelines, procedures, regulations, and laws to ensure compliance.
- Manage a team of security administrators, analysts, and IT professionals.
- Assess, test, and select new security products and technologies.
- Communicate the value of IT security to stakeholders at all levels of the organization.
Knowledge and Skills
- Business continuity and disaster recovery continuity of operations plans
- Applicable laws, statutes, presidential directives, and executive branch guidelines
- IT supply chain security and supply chain risk management policies
- Controls related to the use, processing, storage, and transmission of data
- Current and emerging threats and threat vectors
- Creating policies that reflect system security objectives
- The organization's enterprise IT goals and objectives
- New and emerging IT and cybersecurity technologies
How to Become an Information Security Manager
The Bureau of Labor Statistics notes that an IT security manager may need to have worked as an information security analyst, and that certification may be particularly relevant for computer and information systems managers who oversee IT security.
A NICCS job profile for the information systems security manager lists a bachelor's degree in cybersecurity or computer science as required. It names soft skills such as strong leadership, good communication, efficient multitasking, creative problem solving, and comfort with delegating.
ISACA describes the cybersecurity manager, a role it says may also be called information security manager, as overseeing a specific area within an organization and typically managing a team of employees and augmented staff. According to ISACA, information security management roles generally require an undergraduate degree.
ISACA's Certified Information Security Manager (CISM) certification requires 5 years of experience in information security management, with at least 3 years in 3 of the 4 CISM job practice areas. A current ISACA CISA or ISC2 CISSP certification, or an MBA or a master's degree in information security or a related field, can replace 2 years of that experience, and only one such substitution applies.
Certifications
20 certificationsThe DoD 8140 Qualification Matrix V2.1 lists 20 certifications as qualification options for DCWF work role 722 Information Systems Security Manager, up to the proficiency level shown. Options aligned to a higher proficiency level also qualify for the lower levels.
| Certification | Issuer | DoD 8140 level |
|---|---|---|
| CISM Certified Information Security Manager · ISACA | ISACA | Up to Advanced |
| CISSP Certified Information Systems Security Professional · ISC2 | ISC2 | Up to Advanced |
| CISSP-ISSMP Information Systems Security Management Professional · ISC2 | ISC2 | Up to Advanced |
| FITSP-M Federal IT Security Professional-Manager-NG · Federal IT Security Institute | Federal IT Security Institute | Up to Advanced |
| GCIA GIAC Certified Intrusion Analyst · GIAC | GIAC | Up to Advanced |
| GCIH GIAC Certified Incident Handler · GIAC | GIAC | Up to Advanced |
| GICSP Global Industrial Cyber Security Professional · GIAC | GIAC | Up to Advanced |
| GSLC GIAC Security Leadership · GIAC | GIAC | Up to Advanced |
| CCISO Certified Chief Information Security Officer · EC-Council | EC-Council | Up to Intermediate |
| CCSP Certified Cloud Security Professional · ISC2 | ISC2 | Up to Intermediate |
| CGRC/CAP Certified in Governance, Risk and Compliance · ISC2 | ISC2 | Up to Intermediate |
| CISSO Certified Information Systems Security Officer · United America Technoloiges, LLC | United America Technoloiges, LLC | Up to Intermediate |
| Cloud+ CompTIA Cloud+ · CompTIA | CompTIA | Up to Intermediate |
| GCSA GIAC Cloud Security Automation · GIAC | GIAC | Up to Intermediate |
| GMON GIAC Continuous Monitoring Certification · GIAC | GIAC | Up to Intermediate |
| GSEC GIAC Security Essentials · GIAC | GIAC | Up to Intermediate |
| Security+ CompTIA Security+ · CompTIA | CompTIA | Up to Intermediate |
| SecurityX / CASP+ CompTIA SecurityX · CompTIA | CompTIA | Up to Intermediate |
| SSCP Systems Security Certified Practitioner · ISC2 | ISC2 | Up to Intermediate |
| CC Certified in Cybersecurity · ISC2 | ISC2 | Up to Basic |
Frequently Asked Questions
What does an information security manager do?→
An information security manager advises senior management on risk levels and security posture, oversees the information security training and awareness program, supervises protective or corrective measures when an incident or vulnerability is discovered, and tracks audit findings until mitigation actions are taken.
How do you become an information security manager?→
The Bureau of Labor Statistics notes that an IT security manager may need to have worked as an information security analyst first. A NICCS job profile for the role lists a bachelor's degree in cybersecurity or computer science, and ISACA's CISM certification requires 5 years of experience in information security management.
What skills does an information security manager need?→
The Information Systems Security Manager work role lists knowledge of business continuity and disaster recovery plans, applicable laws and executive branch guidelines, IT supply chain risk management, and current and emerging threats, along with skill in creating policies that reflect system security objectives. ISACA lists vulnerability management, risk analysis, risk management, incident response, and identity and access management among the technical skills employers most often request for cybersecurity manager roles.
What certifications are relevant for an information security manager?→
ISACA states that its CISM certification affirms the ability to assess risks, implement effective governance, and respond to incidents. NICCS lists ISACA's CISM course under the NICE Framework's Systems Security Management and Executive Cybersecurity Leadership work roles. The Bureau of Labor Statistics notes that certification may be particularly relevant for managers who oversee IT security.
Is an information security manager the same as a cybersecurity manager?→
ISACA says the cybersecurity manager role may also be referred to as information security manager. It describes the role as overseeing a specific area within an organization and typically managing a team of employees and augmented staff so that the area operates smoothly.
Which DCWF work role covers information security manager work?→
DCWF work role 722, Information Systems Security Manager, is responsible for the cybersecurity of a program, organization, system, or enclave. Its alternative titles include information systems security officer (ISSO), cybersecurity officer, and information assurance security manager.
Sources
- CISA: Information Systems Security Manager work role
- NICCS: NICE Framework Systems Security Management work role
- BLS Occupational Outlook Handbook: Computer and Information Systems Managers
- NICCS: Information Systems Security Manager job profile
- ISACA: Cybersecurity Manager career page
- ISACA: Information Security Management career area
- ISACA: CISM certification
- ISACA: Requirements to become CISM certified
- NICCS: Certified Information Security Manager (CISM) from ISACA
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. Certification options come from the DoD 8140 Qualification Matrix V2.1 (2025-09-19); the matrix and a specific job posting are the authority for a given position. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.