Job Details

At B. Braun, we protect and improve the health of people worldwide. You support this vision, bringing expertise and sharing innovation, efficiency and sustainability as values.

Company: B. BRAUN MEDICAL (US) INC

Job Posting Location: Bethlehem, Pennsylvania, United States

Functional Area: Information Technology

Working Model: Hybrid

Days of Work: Wednesday, Tuesday, Thursday, Friday, Monday

Shift: 5X8

Relocation Available: No

Job Summary

The Manager IT Security provides guidance and solutions concerning the effective implementation of reasonable and appropriate Information Security controls necessary to protect information assets and the supporting environment.

Responsibilities

• Provides technical expertise and support in operational and implementation aspects of Information Security framework controls, activities, and products.
• Assess and support Information Security controls, risk, and exposure for new and existing infrastructure and processes.
• Reviews newly provisioned and existing systems to assure alignment with security architecture standards; meet security requirements; and identify potential exposure to risk.
• Assesses new projects and implementations to assure expected security controls are in place.
• Maintains an awareness of existing and proposed security standards groups, state and federal legislation and regulations pertaining to information security and identify regulatory changes that will affect information security policy, standards and procedures.
• Performs, supports and coordinates forensic analysis as necessary to support security investigations and supports incident response in security breaches.
• Keeps informed of current technologies, trends, standards, and industry issues related to security and risk management.
• Defines and revises SOPs and system validation plans as required to meet corporate business needs and supports the company's regulatory requirements.
• Prepares project status reports to inform management of project progression. Identifies any issues, which need to be escalated for resolution or assistance.

Qualifications

• Bachelor's degree required or equivalent combination of education and experience.
• 10-12 years related experience required.
• Applicable industry/professional certification preferred.
• Regular and predictable attendance
• Ability to work non-standard schedule as needed, On-call hours as needed

Security & Compliance Lead Responsibilities

• Architect & Own the Security Posture – Map threat models, design layered defenses, and maintain a roadmap aligned with CIS Benchmarks, NIST SP 800-53, ISO 27001, PCI DSS v4, GDPR/CCPA, and other relevant standards.
• Automate Security in the SDLC – Embed SAST, DAST, SCA, container, and IaC scans into CI/CD pipelines; enforce risk-based “security gates” with documented risk acceptance.
• Lead Compliance & Governance – Drive external audits (PCI, SOC 2, HIPAA, etc.), automate evidence collection in SIEM/GRC platforms, and present risk posture in clear business language to executives.
• Direct Incident Response – Maintain version-controlled IR playbooks, coordinate triage/forensics/post-mortems, run quarterly tabletop exercises, and reduce MTTR with automation-ready runbooks.
• Drive Vulnerability & Threat Management – Correlate threat intel and CVE feeds with the asset inventory, prioritize remediation, enforce SLAs, and publish scorecards and risk heat maps.
• Serve as Security Design Authority – Review and approve architectures, pull requests, and infrastructure changes; chair the Security Change Advisory Board (CAB) and validate rollback plans.
• Validate Defenses Offensively – Execute penetration tests and purple-team exercises; oversee continuous attack surface mapping, remediation, and retesting.
• Operate & Optimize Security Tooling – Manage WAF, SIEM, EDR, and cloud/SaaS guardrails across AWS, Azure, GCP, and key SaaS platforms; optimize detections and dashboards.
• Mentor & Evangelize – Publish secure coding standards, deliver developer/SRE training, and foster a security-first culture across teams.
• Measure & Improve – Define and track KPIs/KRIs (e.g., vulnerability age, scan coverage, incident MTTR, automation ROI, playbook effectiveness) and drive quarterly improvements.
• Evaluate & Integrate AI/ML – Assess anomaly-detection models, LLM-assisted code review, and automated playbook generation while ensuring privacy, bias, and compliance controls.

We are an equal opportunity employer. We evaluate applications without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected characteristic.