Cybersecurity Program Manager Jobs in Austin, TX

Job Purpose

The Senior Manager, Cybersecurity leads and owns Hyliion's overall day-to-day cybersecurity program - endpoint security, identity and Conditional Access, cloud/SaaS security posture, and AI governance - across a cloud-native, Microsoft-centric technology environment, budget, and vendor relationships that support it. This includes maintaining the System Security Plan (SSP) and control set for Hyliion's CMMC Level 2 certified enclave, sustaining NIST 800-171 compliance. Beyond the enclave, this role directs Microsoft Entra ID Conditional Access, the Microsoft Defender suite, endpoint management (patching, EDR, and device compliance), our Red Canary Managed Detection and Response (MDR) partnership, and the security and governance of our growing SaaS and enterprise AI footprint across the broader organization, serving as Hyliion's senior-most hands-on cybersecurity leader and primary escalation point for security matters.

AI at Hyliion

At Hyliion, AI is core to how we work. We equip every team member with leading AI tools and count on you to use them - to move faster, solve harder problems, and help us realize the full potential of KARNO technology for the world.

Duties and Responsibilities

• Leadership & Program Management
  • Serve as Hyliion's cybersecurity people leader - hire, onboard, train, mentor, and manage performance for cybersecurity team members as the function grows.
  • Own the cybersecurity program roadmap and budget, including prioritization of tooling investments, headcount planning, and vendor/contract negotiations (e.g., Red Canary MDR, Microsoft security licensing).
  • Serve as the primary escalation point and executive liaison for significant cybersecurity incidents, coordinating cross-functional response with Legal, Communications, and executive leadership.

• Cybersecurity Operations
  • Own and maintain Hyliion's overall day-to-day cybersecurity posture across the enterprise, spanning identity, endpoint, cloud/SaaS, and AI governance.
  • Maintain the System Security Plan (SSP) and control implementation for Hyliion's CMMC Level 2 (C3PAO)-certified enclave, sustaining NIST 800-171 compliance and annual affirmation in SPRS for that defined scope.
  • Administer and continuously optimize Microsoft Entra ID (Azure AD) Conditional Access policies, identity protection, and Privileged Identity Management (PIM) to enforce least-privilege and zero-trust principles.
  • Own endpoint security end-to-end - patch management, vulnerability remediation, EDR fleet health, and compliance baselines across Windows, macOS, and mobile endpoints - using Microsoft Defender for Endpoint and Intune.
  • Manage the broader Microsoft Defender suite (Defender for Office 365, Defender for Cloud Apps, Defender for Identity), including policy tuning, alert triage, and threat response.
  • Serve as the primary point of contact for the Red Canary Managed Detection and Response (MDR) partnership, coordinating incident escalations, tuning detections, and reviewing threat intelligence reports.
  • Administer Mobile Device Management (MDM)/Intune enrollment, compliance policies, and configuration across corporate and BYOD devices.
  • Own security posture and governance across Hyliion's growing SaaS application footprint (SaaS Security Posture Management), including OAuth/app permission reviews, shadow IT discovery, and third-party app risk assessment.
  • Govern the secure and compliant use of enterprise AI platforms - monitoring usage, enforcing acceptable-use and data-handling policies, assessing AI vendor risk, and identifying unsanctioned ("shadow AI") tool adoption.
  • Monitor, triage, and respond to day-to-day cybersecurity incidents and alerts, ensuring timely containment, remediation, and documentation.
  • Maintain and update security policies, procedures, and control documentation supporting NIST 800-171, CMMC, SOX IT general controls, and other applicable frameworks.
  • Support recurring internal and third-party audits, evidence collection, and control testing, including SOX ITGC, CMMC annual affirmation, and cyber insurance renewal questionnaires.
  • Partner with business leaders across departments to assess and mitigate information security risk in new projects, vendor relationships, SaaS adoption, and AI tool deployments.
  • Own and present Hyliion's executive-level cybersecurity dashboard and risk reporting cadence directly to leadership..
  • Contribute to and maintain the company's incident response, business continuity, and disaster recovery plans, participating in periodic tabletop exercises.
  • Stay current on emerging threats and regulatory changes - including AI/LLM-specific risks (e.g., OWASP Top 10 for LLM applications, data leakage, prompt injection) and DFARS/CMMC/NIST developments - and recommend proactive improvements.
  • Additional duties and responsibilities as assigned, needed, or required for the business.

Qualifications

Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

Qualifications include:

• Education, Experience and Certifications
  • Bachelor's degree in Computer Science, Information Systems, or related field.
  • 8+ years of IT/cybersecurity experience, including at least 2 years in a leadership or people-management capacity.
  • CISSP, CISM, Security+, Azure Security Engineer Associate (AZ-500), Microsoft SC-200, or other relevant security certification preferred.

• Skills and Abilities
  • Proven experience leading, mentoring, and developing a cybersecurity or IT team, including hiring and performance management.
  • Experience owning a security program budget and managing vendor/partner relationships and contract negotiations.
  • Ability to balance hands-on technical execution with team leadership in a lean, fast-paced organization.
  • Hands-on administration experience with Microsoft Azure/Entra ID, including Conditional Access, Identity Protection, and Privileged Identity Management (PIM).
  • Experience with endpoint security operations - patch management, vulnerability remediation, and EDR administration (Microsoft Defender for Endpoint or equivalent).
  • Experience managing the Microsoft Defender suite and Microsoft Purview/Compliance Center.
  • Experience working with a Managed Detection and Response (MDR) provider (e.g., Red Canary, CrowdStrike), including alert triage and incident response coordination.
  • Experience administering MDM/Intune for endpoint compliance and device management.
  • Familiarity with SaaS Security Posture Management (SSPM) or CASB concepts and experience securing a cloud-native, SaaS-first technology environment.
  • Familiarity with AI/LLM security considerations (e.g., OWASP Top 10 for LLM Applications, data leakage prevention, shadow AI risk) and experience governing enterprise AI tool usage (e.g., Copilot, Claude, ChatGPT Enterprise).
  • Working knowledge of NIST 800-171, CMMC 2.0, DFARS, SOX IT general controls, or similar regulatory/compliance frameworks.
  • Ability to handle multiple competing priorities in a fast-paced environment.
  • Ability to work well under minimal supervision.
  • Manufacturing industry experience (preferred).
  • Additional duties and responsibilities as assigned, needed, or required for the business.

Role Classification and Working Conditions

This is a salaried, exempt-level position. This position typically works in an office environment; and given the nature of our business is also exposed to operations/warehouses/production environments.