Information Security Manager

ABOUT SOTHEBY'S Established in 1744, Sotheby’s promotes access and ownership of exceptional art and luxury objects through auctions, private sales and retail. Our deep expertise across 70 selling categories is supported by a leading technology platform and a global network of specialists spanning 40 countries.

THE ROLE As an Information Security Manager, you will be responsible for executing major components of Sotheby’s information security strategy, as well as helping to define it. Reporting directly to the CISO, you will be the driving force behind accomplishing key initiatives, while working closely with managers across the globe to balance achieving business objectives with managing risk. Rather than being confined to a narrow role, you will be a utility player, moving between different areas as needed, for example: performing risk assessments and security reviews, procuring infosec tools, managing projects, drafting policies and processes, conducting risk management meetings, designing controls, overseeing auditors, and leading incident response.

RESPONSIBILITIES

• Work with IT and business unit managers to drive security initiatives to completion
• Lead business continuity and disaster recovery planning and preparation projects
• Lead internal and external security audits, acting as the primary point of contact for auditors
• Draft, update, and enforce information security policies, processes, and standards
• Conduct third‑party vendor risk assessments and internal security risk assessments
• Maintain risk registers, compliance dashboards, and reports for senior leadership
• Audit internal systems to verify compliance with mandatory security controls
• Develop policies, processes, and risk assessments aligned to top frameworks such as CIS, NIST, ISO 27001, and SOC 2
• Crosswalk and harmonize controls across multiple compliance frameworks
• Document security requirements, support control implementation, and help track remediation progress
• Build risk registers, support assessments, and monitor remediation progress
• Plan, lead, and execute control validation and testing activities across various domains (e.g., access management, vulnerability management, incident response, data protection)
• Mentor junior analysts and engineers, providing guidance on control validation methodologies and best practices while fostering a culture of accountability
• Document control issues and collaborate with stakeholders to develop remediation recommendations
• Develop and enhance control testing methodologies, procedures, and reporting mechanisms

REQUIRED QUALIFICATIONS

• At least five years of hands‑on experience in information security roles
• Bachelor's or Master's in computer science, engineering, or cybersecurity
• Deep understanding of information security fundamentals
• Proven ability to manage complex projects from conception to completion
• Ability to explain complex technical risks in simple, business-friendly language
• Ability to communicate clearly, precisely, and concisely

PREFERRED QUALIFICATIONS

• At least one active credential, such as CISA, CRISC, CISM, or CISSP
• Experience performing risk assessments across diverse systems including SaaS and mobile
• Deep knowledge of frameworks and standards such as CIS, ISO 27001, and NIST
• Experience leading incident response through a cyberattack or data breach