IT Cybersecurity & Compliance Manager

We need to output HTML fragment with sections only if real content. Use

for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not repeat job title. No Job ID. Remove boilerplate. Include only sections with real specific content. Let's parse posting: - Intro about values, employee-owned, summary: "The Manager of Cybersecurity and Compliance helps operate and mature..." This is about the role. Could be "About the role" section. - Then "Essential Duties & Responsibilities" with subcategories: Cybersecurity and Compliance Program Operations, Governance, Risk, and Compliance Support, Security Operations Coordination, Vendor, Consultant, and Cross-Functional Leadership, Cybersecurity Awareness and Team Baker Education, Mentorship and Dotted-Line Talent Development. These are responsibilities. - Then "Experience, Education Required Qualifications" includes Required Qualifications and Preferred Qualifications. Could be "Requirements" and "Qualifications"? The instruction: Use headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide mapping. We have required qualifications (experience, education). Preferred qualifications also. Could combine into "Requirements" (required) and "Qualifications" (preferred) or "Skills". But we have also skills listed: strong written/verbal communication, organization, etc. Those could go under Skills. We have Benefits section with ESOP description. Pay section: "Pay Transparency The starting salary for this opportunity range is listed. Other rewards may include annual bonus eligibility..." It mentions salary range is listed but not actually given; they say "starting salary for this opportunity range is listed." No actual numbers. According to rule: never create Pay/Schedule/Benefits sections unless posting actually states them. It does mention benefits (ESOP, health insurance, etc.) so Benefits section is okay. Pay: they mention "starting salary for this opportunity range is listed" but no actual numbers; it's vague. It says "Please note that the compensation information is a good-faith estimate for this position." No actual numbers. This might be considered not specific; we should not create Pay section because no concrete salary range or numbers. So omit Pay. Schedule: no mention. Omit. Skills: we have strong written and verbal communication skills, strong organization, follow-through, judgment, discretion, ability to manage competing priorities. Also maybe technical skills: working knowledge of IAM, endpoint security, etc. Those could be under Skills. Requirements: required qualifications (3-5 years experience, practical experience supporting framework, experience coordinating audits, etc.) Could be under Requirements. Qualifications: preferred qualifications (Bachelor's degree, certifications, experience with Microsoft tools, etc.) Could be under Qualifications. But we also have "Experience, Education Required Qualifications" heading. We'll split. We need to preserve all substantive info. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, skills, benefits. We must not repeat job title. Use

for each section heading. We need to use

• for any list of duties/requirements/benefits, and

  for prose. We should not include filler like "commensurate with experience". Not present. We need to remove boilerplate: EEO, acknowledgements, etc. Also remove "If you are selected for an interview..." etc. Also remove "Please note that the compensation information is a good-faith estimate..." maybe borderline but it's about pay; we are omitting Pay section anyway, so we can drop that sentence. Also remove "At Baker Electric we are energized by truly living our values..." maybe that's part of About the role? It's values statement; could be included in About the role prose. We need to preserve all substantive information: values statement, employee-owned, summary, duties, responsibilities, required qualifications, preferred qualifications, skills, benefits. Let's craft sections:

  About the role

  At Baker Electric we are energized by truly living our values - Team Builders, Relentless Follow Through, All-In, and Care for Others. When our team members work together with these things in mind, we do great things both individually and as an organization. Being an employee-owned company shows our drive for sustainable, long-term growth while enhancing the lives of our team members. The Manager of Cybersecurity and Compliance helps operate and mature Baker Electric’s cybersecurity, risk, and compliance programs. This role is responsible for coordinating day-to-day program execution, maintaining core controls and evidence, supporting cybersecurity and compliance initiatives, and partnering with internal IT teams, business stakeholders, vendors, and consultants to reduce risk while enabling business operations. This is a hands-on manager role for an early-to-mid level cybersecurity and compliance leader. The role does not have direct reports, but will manage vendor and consultant relationships, coordinate cross-functional work, and mentor aspiring cybersecurity and compliance talent within the IT Operations team through a dotted-line partnership.

  That seems good.

  Responsibilities

  • Cybersecurity and Compliance Program Operations
    • Coordinate day-to-day execution of Baker Electric’s cybersecurity, risk, and compliance activities in partnership with the Director of IT Operations.
    • Maintain cybersecurity and compliance plans, policies, standards, procedures, evidence repositories, and recurring program artifacts.
    • Track progress on security and compliance initiatives, risks, exceptions, audit findings, and remediation activities.
    • Prepare regular updates, metrics, and status reporting for IT leadership and appropriate business stakeholders.
  • Governance, Risk, and Compliance Support
    • Support implementation and ongoing improvement of compliance programs such as NIST Cybersecurity Framework, NIST SP 800-171, CMMC Level 2, CIS Controls, or equivalent frameworks.
    • Maintain and update System Security Plans, Plans of Action and Milestones, control evidence, assessment records, and audit-readiness materials.
    • Coordinate internal reviews, external assessments, third-party audits, and follow-up actions with vendors, consultants, and internal teams.
    • Translate compliance requirements into practical action plans for IT Operations, Service Desk, Infrastructure, Applications, and business teams.
  • Security Operations Coordination
    • Coordinate vulnerability management, endpoint protection, identity and access management, security monitoring, logging, incident response readiness, and remediation activities.
    • Partner with internal IT teams and external service providers to ensure security tools, alerts, tickets, and remediation work are followed through to completion.
    • Support incident response planning, tabletop exercises, post-incident documentation, and continuous improvement actions.
    • Manage third-party security reviews and vendor risk follow-up for technology providers and critical business systems.
  • Vendor, Consultant, and Cross-Functional Leadership
    • Manage day-to-day working relationships with cybersecurity and compliance vendors, consultants, assessors, managed service providers, and other external partners.
    • Clarify deliverables, timelines, responsibilities, and communication expectations for external partners and internal contributors.
    • Coordinate work across teams without relying on formal reporting authority, holding stakeholders accountable to agreed-upon actions and deadlines.
    • Escalate risks, resource needs, and prioritization conflicts to the Director of IT Operations with clear options and recommendations.
  • Cybersecurity Awareness and Team Baker Education
    • Develop practical cybersecurity and compliance education for Team Baker, including recurring awareness content, targeted communications, and training materials.
    • Partner with IT, HR, Safety, Operations, and other business leaders to make cybersecurity expectations clear, relevant, and actionable.
    • Promote a culture of shared ownership, accountability, and care for others through simple, consistent security practices.
    • Measure and improve awareness program effectiveness using available training metrics, incident trends, simulated phishing results, or other relevant indicators.
  • Mentorship and Dotted-Line Talent Development
    • Mentor IT Operations team members who are developing cybersecurity and compliance skills.
    • Provide coaching, learning assignments, and guidance on security operations and compliance fundamentals in partnership with the Service Desk Manager.
    • Help identify opportunities for IT Operations team members to contribute to security-related tickets, evidence gathering, and process improvements.
    • Model Baker’s TRAC values and OneBaker leadership through collaboration, follow-through, accountability, and care for others.
  But we need to ensure we only use
  • for any list. The above uses nested lists; that's okay. Now Requirements section: required qualifications.

    Requirements

    • At least 3 to 5 years of experience in cybersecurity, information security, compliance, IT risk management, security operations, or a closely related IT discipline.
    • Practical experience supporting at least one cybersecurity or compliance framework, such as NIST Cybersecurity Framework, NIST SP 800-171, CMMC, CIS Controls, ISO 27001, or equivalent.
    • Experience coordinating audits, assessments, evidence collection, control testing, vulnerability remediation, or security program initiatives.
    • Experience working with cybersecurity tools, managed security providers, consultants, or external assessors.
    • Working knowledge of identity and access management, endpoint security, vulnerability management, security monitoring, incident response, Microsoft 365 security, Entra ID, and cloud security concepts.
    • Strong written and verbal communication skills, including the ability to explain security and compliance topics to technical and non-technical audiences.
    • Strong organization, follow-through, judgment, discretion, and ability to manage competing priorities.
    But note that communication skills and organization etc could also be under Skills. However they are listed under Required Qualifications. We could keep them there; but we might also create a Skills section for those soft skills. However we must not duplicate content. The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. If we put them under Requirements, that's fine. We could also create a Skills section for technical skills like working knowledge of IAM etc. But we already have those under Requirements. Might be okay to have only Requirements and Qualifications sections, and not a separate Skills. However the instruction list includes Skills as a possible heading; we can omit if not needed. But we have technical skills like "Working knowledge of identity and access management, endpoint security, vulnerability management, security monitoring, incident response, Microsoft 365 security, Entra ID, and cloud security concepts." That's a skill. Could be under Skills. But we also have communication skills etc. Might be better to split: Requirements for experience/education, Qualifications for preferred, Skills for both technical and soft skills. However we risk duplication if we also list them under Requirements. Let's think: The posting lumps required qualifications includes experience, practical experience, experience coordinating audits, experience working with tools, working knowledge of certain areas, strong communication skills, strong organization etc. Those are all required. So we could put all under Requirements. Then Qualifications for preferred (degree, certifications, experience with Microsoft Defender etc). That would avoid duplication. Thus we will not have a separate Skills section. Now Qualifications (preferred):

    Qualifications

    • Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Systems, or a related field, or equivalent practical experience.
    • Relevant certifications such as Security+, CySA+, SSCP, GSEC, CISM, CISSP, CRISC, Certified CMMC Professional, Certified CMMC Assessor, or equivalent.
    • Experience with Microsoft Defender, Purview, Sentinel, Intune, Azure security services, or similar platforms.
    • Experience developing cybersecurity