The primary goal in project portfolio management is to select and manage the optimal set of projects that contribute the maximum in business value. However, selecting Information Technology (IT) projects is a difficult task due to the complexities and uncertainties inherent in the strategic-operational nature of the process, and the existence of both quantitative and qualitative criteria. We propose a two-stage process to select an optimal project portfolio with the aim of maximizing project benefits and minimizing project risks. We construct a two-stage hybrid mathematical programming model by integrating Fuzzy Analytic Hierarchy Process (FAHP) with Fuzzy Inference System (FIS). This hybrid framework provides the ability to consider both the quantitative and qualitative criteria while considering budget constraints and project risks. We also present a real-world case study in the cybersecurity industry to exhibit the applicability and demonstrate the efficacy of our proposed method.