Business Information Security Officer

Accountabilities:

Develop and implement cybersecurity strategies aligned with business objectives, enterprise risk management priorities, and applicable regulatory requirements.
Identify, assess, prioritize, and mitigate information security risks across business units using established risk management frameworks and industry best practices.
Serve as the primary liaison between business stakeholders, the Chief Information Security Officer (CISO), and Information Security and Risk Management (ISRM) teams, ensuring effective communication and strategic alignment.
Advise senior executives and business leaders on cybersecurity risks, emerging threats, security investments, and mitigation strategies to support informed decision-making.
Establish and lead a Business Information Security Officer (BISO) advisory capability, bringing together IT, legal, risk management, and business representatives to coordinate security priorities and initiatives.
Support the design and implementation of global security solutions that strengthen enterprise security capabilities while addressing business-specific requirements.
Ensure security policies, controls, and practices align with recognized frameworks, including ISO 27001 and the NIST Cybersecurity Framework (CSF), as well as relevant compliance obligations.
Coordinate incident response activities, facilitating timely engagement among security teams and business stakeholders during cybersecurity incidents.
Lead post-incident reviews and tabletop exercises to evaluate response effectiveness, identify vulnerabilities, and improve organizational preparedness.
Design and deliver security awareness and training programs that strengthen employee understanding of cybersecurity threats, responsibilities, and best practices.
Promote a proactive security culture across all organizational levels, integrating risk awareness into business processes, technology initiatives, and operational decisions.
Apply project management, data analytics, and problem-solving methodologies to evaluate security performance, track initiatives, and drive continuous improvement.
Collaborate with internal teams and external partners to assess security requirements, evaluate solutions, and support effective vendor and contract negotiations where necessary.
Monitor evolving cybersecurity threats, technologies, and regulatory developments to identify opportunities to improve the organization's overall security posture.
Requirements:
Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field, with at least 10 years of relevant professional experience; alternatively, a master's degree with at least 9 years of relevant experience.
Demonstrated experience in a senior information security leadership or executive role, with a strong understanding of enterprise cybersecurity strategy, governance, and risk management.
Proven experience acting as a trusted advisor to executives and key stakeholders, translating complex security challenges into practical business recommendations.
Experience designing and implementing global cybersecurity solutions across diverse business units, technical environments, and organizational structures.
In-depth knowledge of information security management frameworks, particularly ISO 27001 and NIST CSF, along with regulatory compliance requirements and industry security standards.
Strong expertise in cybersecurity risk assessment, risk mitigation planning, security governance, and the evaluation of security controls.
Experience coordinating incident response, crisis management, post-incident reviews, and security preparedness exercises.
Excellent communication, presentation, and interpersonal skills, with the ability to engage effectively with senior executives, technical teams, legal professionals, and business stakeholders.
Strong leadership, project management, analytical, and problem-solving capabilities, including the ability to manage competing priorities and drive cross-functional initiatives.
Demonstrated ability to foster collaboration between cybersecurity functions and business operations, promoting a risk-aware culture while supporting organizational objectives.
Professional certifications such as CISSP, CISM, CRISC, or CISA, with at least two of these credentials required.
Preferred: Advanced degree in cybersecurity, information systems, risk management, or a related discipline.
Preferred: Experience negotiating contracts, managing vendors, and evaluating third-party security capabilities.
Preferred: Extensive expertise in cybersecurity risk management, including conducting assessments, identifying control gaps, and recommending appropriate remediation strategies.
Preferred: Previous experience serving as a Chief Information Security Officer (CISO) within a medium-sized or large enterprise.
Strong adaptability and strategic judgment, with the ability to navigate complex organizational environments and balance security requirements with business needs.
No security clearance is required for this position.
Benefits:
Annual base salary: $125,100–$225,200, depending on qualifications, experience, and other relevant factors.
Comprehensive healthcare coverage: Medical, dental, and vision insurance options.
Retirement savings: Access to a 401(k) plan to support long-term financial planning.
Employee ownership: Participation in an Employee Stock Ownership Plan (ESOP), subject to applicable plan terms.
Life insurance: Coverage options to support employees and their families.
Paid time off: Paid leave and company holidays to encourage a healthy work-life balance.
Flexible work arrangements: Remote work opportunity within the United States, with flexible scheduling options.
Professional development: Opportunities to expand executive leadership capabilities, deepen cybersecurity expertise, and contribute to enterprise-wide security initiatives.
Strategic impact: The opportunity to influence cybersecurity governance, strengthen organizational resilience, and align security investments with business priorities.
Collaborative environment: Work with multidisciplinary teams and senior stakeholders to address complex security challenges and deliver innovative solutions.
Career growth: Opportunities to develop professionally while contributing to high-impact corporate cybersecurity programs.