Lead Cybersecurity Specialist

CentiMark Corporation is hiring a Lead Cybersecurity Specialist in our Canonsburg headquarters in SouthPointe! This is a full in-office role with an established company that is both family-founded and 100% employee-owned through our Employee Stock Ownership Program (ESOP).

The Lead Cybersecurity Specialist is an operational, hands-on position that will own, mature, and defend our enterprise cybersecurity environment. Reporting directly to the CIO, you will translate contractual and regulatory security requirements into day-to-day administrative policies and direct our external Managed Security Services Provider (MSSP).

This role is responsible for maturing our current CIS Controls baseline toward NIST CSF, NIST SP 800-171, and customer-mandated CMMC requirements. You will also take active ownership of enterprise-grade Data Loss Prevention (DLP) across Google Workspace, SAP, and Salesforce, while establishing real-world security guardrails for our enterprise AI adoption (Google Gemini).

 

Key Responsibilities

Security Maturity, Framework Alignment & Roadmapping:

• Execute and mature the multi-year IT Cybersecurity Roadmap under the direction of the CIO
• Advance our defensive posture from our current CIS Critical Security Controls (v8) baseline to satisfy customer-driven NIST CSF, NIST SP 800-171, and CMMC Level 2 compliance requirements
• Translate contractual and regulatory security requirements into day-to-day administrative policies, identity controls, and operational runbooks
• Maintain an auditable repository of security policies, evidence artifacts, and compliance documentation

• Design, implement, tune, and monitor enterprise DLP policies across core business platforms: Google Workspace (Drive, Gmail), Salesforce CRM, and SAP ERP
• Classify sensitive commercial, financial, and customer data; establish strict egress boundaries and access controls to prevent data exfiltration
• Build operational governance, prompt hygiene standards, and data perimeter rules for enterprise generative AI tooling (Google Gemini)
• Partner with sales operations and customer service leaders to ensure data protection controls support high-speed commercial workflows

 

"Working Manager" Operations & MSSP Oversight:

• Direct our 24/7/365 external Managed Security Services Provider (MSSP / MDR), holding them accountable to SLAs, threat detection fidelity, and alert escalation protocols
• Directly manage, configure, and audit core security tools: Endpoint Detection and Response (EDR), Identity and Access Management (IAM/SSO/MFA), email hygiene filters, and vulnerability management scanners
• Serve as the primary internal technical escalation point for security events, anomalous behavior investigations, and triage

Cyber Assurance: Pen Tests & Incident Response:

• Scope, coordinate, and oversee annual third-party external/internal penetration tests; track vulnerability remediation through completion with infrastructure teams
• Design, coordinate, and lead annual tabletop exercises (TTX) for cybersecurity incidents, testing response readiness across IT, Operations, Legal, and Executive leadership
• Maintain and update the Incident Response Plan (IRP), Disaster Recovery (DR) alignments, and business continuity runbooks

Customer Trust & Commercial Enablement:

• Serve as the primary security subject matter expert reviewing customer security questionnaires, RFPs, and Master Services Agreement (MSA) security addendums
• Participate in customer security audits and vendor risk management reviews to accelerate enterprise sales cycles
• Design and execute role-tailored Security Awareness Training programs and ongoing phishing simulations

Candidate Qualifications & Requirements

Experience & Mindset:

• 6–8+ years of progressive hands-on information security experience, including at least 2+ years in a technical lead, supervisory, or management role
• True Working Manager Philosophy: Demonstrated track record of rolling up your sleeves to write policies, review logs, and configure security tools while also coordinating vendor contracts
• Framework Translation: Practical experience implementing or maturing security frameworks from CIS Controls to NIST CSF / SP 800-171 or preparing an environment for CMMC
• MSSP Leadership: Experience holding third-party managed detection and SOC providers accountable for alert triage, false-positive reduction, and threat hunting
• Full-Time On-Site Dedication: Ability to work on-site five days a week at our Canonsburg, PA headquarters, driving hands-on collaboration with executive and cross-functional teams

Technical Proficiencies:

<