Capa Manager Jobs in Massachusetts (NOW HIRING)

The role is to lead and coordinate cybersecurity remediation initiatives across the organization, driving end‑to‑end remediation of security findings generated through scans, assessments, audits, incident reviews, investigations, and continuous monitoring.

• Program Ownership: Lead and coordinate the intake, prioritization, and execution of cybersecurity remediation programs using a structured, data‑driven, risk‑based approach. Manage end‑to‑end delivery of multiple concurrent remediation workstreams across technology and business teams, establish a centralized remediation operating model, define and monitor program metrics, risks, and trends.
• Risk and Remediation Management: Translate findings from vulnerability scans, penetration tests, risk assessments, incidents, audits, and investigations into actionable remediation plans. Partner with teams to move items through verification and closure, own the consolidated findings registry, and provide executive‑level reporting on remediation posture.
• Partner Engagement and Influence: Build relationships across security, engineering, and business teams to create alignment, navigate blockers, influence prioritization, and strengthen secure engineering and operational practices. Provide executive‑ready communications on program status, risks, and decisions.

• 8+ years in Technical Program Management, Cybersecurity Program Management, or similar roles.
• Proven experience leading complex, cross‑functional remediation programs in cybersecurity, infrastructure, or enterprise IT environments.
• Strong understanding of cybersecurity domains such as vulnerability management, incident response, identity, cloud security, and application security.
• Experience working with findings from audits, risk assessments, penetration tests, and security incidents.
• Strong stakeholder partnership and influencing skills in highly matrixed organizations.
• Excellent written and verbal communication skills, including executive‑level communication.
• Ability to define metrics, track progress, and use data to support clear and informed decision‑making.
• Strong listening skills, sound judgment, and a proactive approach to feedback and problem‑solving.

• Experience with GxP environments and regulatory requirements.
• Familiarity with vulnerability management platforms, GRC tools, and security tracking/reporting systems.
• Experience with post‑incident review processes, including RCA, CAPA management, and lessons‑learned programs.
• Experience implementing or scaling enterprise remediation or risk management programs.
• Background in infrastructure, cloud, or security engineering.
• Knowledge of security frameworks (NIST, ISO 27001, CIS).
• Experience driving operational maturity improvements (process, tooling, governance).
• Strong sense of ownership and urgency, balancing risk, timely execution, and business priorities.
• Influential, inclusive, and trusted partner with a collaborative mindset.

• Competitive salary range: $145,900.00 – $234,200.00.
• Health, dental, and vision coverage with voluntary benefit programs.
• A holistic approach to well‑being with fitness, mindfulness, and mental health support.
• Family planning benefits: fertility, adoption, and surrogacy support.
• Generous paid time off, including vacation, volunteer days, sabbatical, global recharge days, and a discretionary year‑end shutdown.
• Savings and investment programs to help plan for the future.

Moderna is committed to equal employment opportunity and non‑discrimination for all employees and qualified applicants without regard to race, color, sex, gender identity or expression, age, religion, national origin, ancestry or citizenship, ethnicity, disability, military or protected veteran status, genetic information, sexual orientation, marital or familial status, or any other personal characteristic protected under applicable law.

This position may involve access to technology or data subject to U.S. export control laws. Employment is contingent upon the applicant’s ability to access export‑controlled information in accordance with U.S. law. Only U.S. persons (citizens, permanent residents, asylees, or refugees) are eligible for this position.