IT Security Manager

“As dedicated stewards of Broomfield, our community-focused team delivers meaningful and impactful services and support.”

The City and County of Broomfield is seeking an experienced and forward-thinking IT Security Manager to lead and advance our enterprise cybersecurity program. This is an opportunity to play a critical role in protecting the systems, data, and technology infrastructure that support essential public services and our community.

As IT Security Manager, you will help shape Broomfield’s cybersecurity strategy, strengthen our security posture, and lead efforts to identify and manage evolving cyber risks. You will join a collaborative and mission-driven IT organization where cybersecurity is viewed as both a technology priority and an organizational responsibility.

About Us 

The IT department is made up of 46 staff in 7 divisions (GIS; DevOps; Customer Success; Project Management; Cybersecurity; Data, Analytics & AI; and Administration) and is responsible for guiding and governing City and County technology focused on business solutions, reliability, innovations, and customer satisfaction. The department is responsible for providing:

• Leadership and vision to support the technology goals and objectives of a diverse, growing community based on solid partnerships with departments

• Reliable and secure infrastructure 

• Responsive and knowledgeable support for business and enterprise technology systems, network services, and desktop support services

• Protection of the confidentiality and preservation of the integrity of the City’s data 

• Robust and scalable telecommunications systems

• Robust GIS environment that allows users to organize, visualize, and analyze different layers of data

The IT leadership team fosters and encourages employee development and growth; offers a flexible, hybrid work schedule; provides a cooperative, collaborative, and FUN team environment; and appreciates and celebrates the team’s accomplishments.

IT Security Manager Total Compensation Package

Anticipated Hiring Timeline:

• Application Review: 11/18/26

• Video Screening Interview: 11/19/26 - 11/29/26

• Virtual Panel Interview: 12/10/26 - 12/16/26

• Finalist Interview Onsite: 1/4/27 - 1/8/27

• Projected start date:  3/3/27

Working Hours/Location

This position offers a flexible, hybrid work environment that supports both in-office and remote work. While the schedule can be adjusted to meet individual productivity needs, the IT Security Manager is expected to maintain reliable availability during core business hours to effectively support customers, stakeholders, and project activities.

About You

• Build and lead an effective cybersecurity team by providing guidance, coaching, and technical mentorship to staff, developing annual performance plans and conducting annual evaluations. 

• Maintain an inclusive work climate which attracts, retains, and motivates a diverse staff of high-performing technology professionals.

• Oversee security requirements, risk assessment, controls, and monitoring for multi-cloud environments (SaaS, IaaS, PaaS), hybrid enterprise infrastructure, and line-of-business applications.  

• Lead, conduct, and maintain security business, infrastructure, and regulatory compliance reviews (NIST CSF 2.0, CJIS, PCI-DSS, HIPAA) and perform ongoing quantitative and qualitative security risk assessments for internal and external information assets.

• Establish and enforce a formal Third-Party Risk Management (TPRM) program to evaluate, audit, and monitor vendor security controls and software supply chain risks prior to contract execution and deployment.

• Establish and enforce enterprise AI security governance by evaluating artificial intelligence (AI) and generative technologies against the NIST AI Risk Management Framework, deploying defensive AI-driven security tools, and maintaining Data Loss Prevention (DLP) controls to mitigate data privacy, compliance, and threat risks across municipal systems. 

• Serve as an enterprise security authority reviewing and approving security controls for network, applications, operating systems, identity management, and endpoint protection solutions for new and upgraded services.  

• Formulate, maintain, and enforce enterprise cybersecurity policies,  procedures, and technical standards that balance business functionality with a comprehensive defense-in-depth security posture. 

• Maintain domain specific knowledge, skills, and industry certifications, staying current with modern cybersecurity management standards, local government compliance mandates, and evolving threat vectors. 

• Investigate known and unknown security threats and incidents, oversee threat hunting activities, document findings, and drive cross-functional remediation plans. 

• Lead the development, maintenance, and execution of the CCOB Cybersecurity Incident Response Plan (IRP), including leading tabletop exercises, managing external incident response partners, and coordinating with CISA or law enforcement agencies when necessary. 

• Analyze threat intelligence feeds to determine risk, exposure, and mitigation strategies.  

• Represent CCOB as an information security subject matter expert and liaison to outside agencies, regional peer groups, and regulatory bodies.

• Oversee city-wide security awareness training to cultivate a strong security-first culture among all employees and officials. 

• Drive security automation across security workflows and incident response tools to eliminate manual overhead and reduce mean time to detect/respond (MTTD/MTTR).  

• Evaluate emerging cyber technologies, cloud architectures, and security solutions, incorporate into the cybersecurity strategic plan, develop budget justification, lead vendor negotiations, and procurement process.

• Collaborate with IT leadership and stakeholders to evaluate, prioritize, and report enterprise cybersecurity risk metrics, strategic initiatives, and budget needs. 

• Oversee protection and continuous monitoring strategies for 1,500+ hybrid endpoints, mobile devices, operational technology (OT/SCADA), and critical infrastructure systems. 

Education

• Degree from an accredited college or university with a bachelor's degree in cybersecurity, computer science, computer information systems, management information systems, or a closely related field. 

• Educational or industry-recognized vocational training in information security, cloud computing (AWS/Azure/GCP), identity management, system and network architecture, database administration, and IT service management.

• Current professional certification in Information Security Management or Leadership (i.e. CISM, CISSP, CISA, etc.) is highly desired.

• Secondary or specialized certifications (e.g., CCSP, GIAC GSLC/GCIH, CompTIA Security+) and ITIL Foundation (v3 or v4) certification are highly preferred. 

Experience

• Six (6) years of progressive experience in cybersecurity, network engineering, or systems administration, to include a minimum of two (2) years of direct supervisory, team lead, or project leadership experience. 

• Experience resolving complex security challenges in a large, geographically distributed, departmentally diverse, or public-facing organization. 

• Hands-on experience securing hybrid environments, Software as a Service (SaaS), cloud infrastructure (AWS, Azure, or Google Cloud), and Microsoft ecosystem solutions including Active Directory and Microsoft Entra ID (Azure AD).  

• Demonstrated experience conducting security risk assessments, executing incident response protocols, and applying regulatory compliance standards (e.g., NIST CSF, CJIS, PCI-DSS, HIPAA) in a public sector or highly regulated environment. 

• Extensive experience with TCP/IP network security, endpoint detection and response (EDR), and identity/access management. 

Years of related experience may be substituted for required education, however education cannot be substituted for the necessary work experience. Candidates must meet the minimum required years of work experience.

NECESSARY SPECIAL REQUIREMENTS (in addition to above requirements):

New hires must, as a condition of employment, pass the following pre-offer and post-offer/hire processes: in-person or virtual interviews, reference checks, and background checks, which may include local police check and sex-offender registry.

If this position is required to drive a CCOB vehicle a DMV check will be required. 

• Must be 18 years of age.

• Must possess and maintain a valid driver’s license and safe driving record for continued employment.

• Fingerprint checks through CBI/FBI required.

(The work environment characteristics and physical demands described here are representative of those an employee encounters while performing the essential functions of the job. Reasonable accommodation may be made to enable individuals with disabilities and neuro-differences to perform the essential functions.)

• Work is generally scheduled Monday-Friday.

• Work involves on-call duty which requires working weekends on a rotating basis and working all hours during emergencies as needed.

• Work is performed at City/County work locations with the ability to perform some duties remotely in accordance with Broomfield's remote work policy

• Physical demands are described as light (exert up to 20 lbs. of force occasionally and/or up to 10 lbs. of force frequently, and/or a negligible amount of force constantly to move objects).