The Sr. Cybersecurity Program Manager is a critical business and compliance role responsible for operational governance, customer assurance, audit readiness, and continuous monitoring of Cornerstone public sector cloud offerings in Canada and the United States. The role leads and coordinates activities supporting Government of Canada Protected B services, FedRAMP Moderate, and the AWS GovCloud / DoD Impact Level 4 (IL4) environment.
The successful candidate ensures authorization commitments are translated into sustainable operating processes, clearly assigned ownership, timely evidence, effective remediation, and transparent government and executive reporting. The role coordinates annual assessments, continuous monitoring, POA&M management, vulnerability governance, corrective action plans, audit evidence, control-owner accountability, customer onboarding readiness, and development of the Cornerstone Protected B solution. This role will support the overall vision of the Cybersecurity Program at Cornerstone OnDemand. This position is part of the global Cybersecurity Engineering and Assurance team and reports to the Sr. Director, Quality & Risk Management.
In this role you will...
Public Sector Program Leadership
Own the integrated cybersecurity program plan, governance cadence, milestones, dependencies, risks, and executive reporting for Protected B, FedRAMP Moderate, and DoD IL4 initiatives.
Serve as a senior program interface across Cybersecurity, Quality & Risk Management, Cloud Operations, Engineering, Product, Legal, Sales, Customer Success, external assessors, government sponsors, and authorizing organizations.
Maintain clear RACI assignments, named control owners, backup coverage, decision logs, risk acceptance records, and escalation paths to avoid single points of failure.
Translate regulatory, authorization, contractual, and customer requirements into actionable work plans and measurable operational outcomes.
Protected B - Canada
Lead cybersecurity program management for existing Protected B services and development, readiness, and operationalization of the Cornerstone Protected B solution.
Coordinate alignment with Government of Canada security expectations, including ITSG-33 risk management practices, applicable cloud control requirements, security assessment and authorization activities, and continuous monitoring.
Support designated Canadian security responsibilities, including government and customer communications, evidence coordination, control ownership, personnel/access requirements, security documentation, and assessment support.
Coordinate data-handling, access, residency, subcontractor, incident, and shared-responsibility requirements applicable to Protected B services.
Maintain program oversight of the authorization boundary, SSP, control implementation statements, policies, procedures, inventories, diagrams, customer responsibility documentation, and supporting evidence.
Ensure findings, risks, and compliance obligations have accountable owners, are tracked to closure, and are escalated when authorization commitments are at risk.
DoD IL4, DISA and GovCloud
Lead cybersecurity program coordination for the DoD IL4 GovCloud environment, including DISA and mission-owner engagements, authorization maintenance, eMASS package coordination, annual 3PAO assessments, continuous monitoring, and customer onboarding readiness.
Coordinate responses to DISA requests, corrective action plans, authorization conditions or restrictions, follow-up questions, evidence requests, and remediation commitments, maintaining complete records of decisions, submissions, approvals, and due dates.
Oversee vulnerability governance across operating systems, containers, repositories, base images, applications, and infrastructure, including named owners, remediation plans, recurring dashboards, POA&M traceability, deviation/risk-acceptance workflows, and evidence.
Ensure reporting provides transparent status of out-of-SLA vulnerabilities, externally or customer-facing exposure, authentication and authorization impacts, remediation progress, and residual risk.
Coordinate GovCloud audit readiness, including control-owner assignments, SSP and IL4 addendum reviews, evidence handling, interview preparation, system demonstrations, CUI-aware screen sharing, assessor follow-ups, and final evidence submission.
Establish governance forums with clear decisions, owners, due dates, and escalation criteria across Security, Cloud Operations, Engineering, and business stakeholders.
Drive root-cause analysis and durable corrective actions for missed assessments, late remediation, evidence gaps, unclear ownership, reduced operational capacity, or insufficient government communication.
Provide concise, fact-based communications to executives, customers, assessors, and government representatives while protecting CUI, Protected B, security-sensitive information, and authorization package materials.
You've got what it takes if you have...
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business, or related field, or equivalent relevant experience.
7+ years of experience in cybersecurity, compliance, risk, audit, cloud security, or public sector program management, including experience leading complex cross-functional programs.
Demonstrated experience supporting a cloud service provider or SaaS organization in regulated public sector environments.
Working knowledge of FedRAMP Moderate, NIST SP 800-53/53A, SSPs, SAPs, SARs, POA&Ms, continuous monitoring, annual assessments, and 3PAO engagement.
Working knowledge of DoD cloud authorization concepts, IL4, DISA authorization processes, eMASS, STIGs, CUI handling, and authorizing-official or mission-owner engagement.
Knowledge of Government of Canada Protected B security expectations, ITSG-33, cloud security controls, shared responsibility, and security assessment and authorization practices.
Experience coordinating external audits, control-owner interviews, system demonstrations, evidence collection, remediation tracking, and government inquiries.
Ability to satisfy personnel screening, residency, citizenship, background-check, and access-eligibility requirements applicable to assigned Canadian and U.S. public sector environments and contracts.
Security and Citizenship Requirements
Must be a Canadian citizen and be physically located in Canada.
Must be eligible to obtain and maintain the Government of Canada security screening required for the role, including at minimum Reliability Status, through Public Services and Procurement Canada's Contract Security Program (PSPC CSP).
Must be eligible for appointment as Cornerstone's Company Security Officer (CSO) and maintain security screening at the level required for Cornerstone's organizational security clearance.
Must be able to satisfy any additional Government of Canada personnel-security requirements applicable to Cornerstone's federal contracts, including eligibility for a Secret security clearance where contractually required.
An extra dose of awesome if...
Hands-on experience supporting both Government of Canada Protected B and U.S. federal or Department of Defense cloud programs.
Experience working directly with Government of Canada departments, DISA, federal agency authorizing officials, mission owners, 3PAOs, or independent security assessors.
Experience with AWS GovCloud, vulnerability scanning, SIEM, ticketing, GRC, and evidence-management platforms.
You apply on The Muse or on the employer's page; AtiveSite does not receive or process applications and is not affiliated with The Muse. The description above is shown as the source published it.
About the role
This is a Senior Level role in the Technology field (Cybersecurity) at Cornerstone OnDemand. Senior roles usually expect substantial experience, ownership of results and often the ability to guide others.
We could not match this job title to one occupation in the official wage statistics, so no pay estimate is shown. Pay is not in the source listing; ask the employer for the range and compare in the 240 job niches.
How to prepare and behave
This is editorial guidance, not information from the employer.
Read the whole description and match your examples to its requirements; use the same words the posting uses where they are true for you.
Research the employer before the interview: what it does, who its customers are and recent news; prepare two or three questions about the work.
Arrive early (or log in early for a video call), dress one step above the daily dress code, and test your camera and audio beforehand.
Answer with short stories: the situation, what you did and the result. Give numbers when you have them and never invent them.
Be honest about gaps; say what you did to learn and how fast you can close them.
Ask about the team, the first 90 days, how success is measured and the schedule; do not open with salary and time off.
When pay comes up, know the market range for the occupation and your lowest acceptable offer before you answer; ask for the full package in writing.
Send a short thank-you message within a day, mentioning one thing you discussed.
The listing mentions a remote or flexible location. Confirm with the employer whether remote work applies to your state: taxes, licensing and benefits can depend on where you live.
Have code, data work or projects you can show, and be ready to think aloud: many technical interviews test how you reason, not only the answer.
The listing is remote or has no US state we could identify. Read the country guide for pay, taxes, law and cost of living by state.
Where to live
The job city has no coordinates we can place on the map, so no housing comparison is shown. Use the 250 largest cities table to compare rent and income.
Career paths
We could not match this title to one occupation, so here are the other sub-niches in Technology, where your skills may carry over:
This job has no single city we can place on the map (remote, flexible or unmatched location), so no distance table is shown. Browse all Technology jobs with distances from any of the 20 largest cities.
We do not hold headcount or revenue for this employer. Check its careers site and, if it is listed on a stock exchange, its public filings (SEC EDGAR search).
What it is like to work at a company (culture, schedules, benefits) is not in the source data, so we do not describe it. Read the description and ask the questions under "How to prepare".
What is the Senior Cybersecurity Program Manager job at Cornerstone OnDemand?
A senior level role in technology (cybersecurity) listed 5 days ago. The full description is on this page and on The Muse.
Where is this job?
Remote / flexible (United States). A remote or flexible location is listed; confirm with the employer which states are accepted.
How do I apply?
Use the "View this job and apply on The Muse" button. AtiveSite does not receive applications.
How much does it pay?
The listing does not publish pay, and we could not match the title to one official occupation.
What is the cost of living there?
See the state or country guide for rent, income and taxes.
How old is this listing?
It was posted on 2026-11-04 (5 days ago). Jobs older than 90 days are not shown.
Are there similar jobs?
Yes: browse cybersecurity jobs in the United States.
Sources and terms
Job data: The Muse public API (listing dated 2026-11-04). The job disappears from this site when it disappears from the source.
Wages and projections: BLS OEWS (May 2025) and Employment Projections 2025–35.
City and county figures: Census Bureau ACS 2020–2024, BEA, BLS QCEW and LAUS, NASA POWER climatology; distances from Census Gazetteer coordinates.
AtiveSite is not affiliated with or endorsed by The Muse, the employer or any government agency, and does not process applications. Verify every detail with the employer before acting.