Senior Business Information Security Officer

PURPOSE AND SCOPE:  

The Business Information Security Officer (BISO) works closely with the information security teams and business units' leadership to ensure cybersecurity and privacy are seamlessly integrated into daily operations. This role provides expert guidance on risk management, drives the implementation of by-design security and privacy controls, and serves as the primary link between business and functions. We’re looking for someone who combines strong strategic thinking with hands-on execution and can operate as a self-starter who fostering a culture of security awareness, supports compliance initiatives, and ensures security practices align with the organization’s overall business strategy. 

The right candidate must have excellent engagement and communication skills and must have a strong customer-focused, team-oriented, approach that balances security needs and user experience to provide best-in-class security to the organization with subject matter expertise in enterprise security architecture governance and industry standard cyber security frameworks, cloud computing, and cloud architecture. 

PRINCIPAL DUTIES AND RESPONSIBILITIES:  

• Ensure that the organization's information assets are protected against unauthorized access, theft, damage, and disruption. 

• Responsible for implementing and maintaining a segment-wide information security strategy aligned to the enterprise strategy.  

• Engage regularly with ITS Business Partners to align business strategy and cybersecurity & privacy strategy. 

• Provide business segment support in navigating cybersecurity and privacy assessments. 

• Contribute to the ongoing information security initiatives and improvements in development, implementation and maintenance of information security. 

• Work closely with engineering, operations, and security specialists to ensure adequate data security solutions and controls are in place throughout all systems and platforms to mitigate identified risks sufficiently, and to meet business objectives and regulatory requirements. 

• Assess and understand the organization’s current security posture and future architecture requirements, providing recommendations for improvement and risk reduction. 

• Provides guidance and advocacy regarding the prioritization of investments that impact information security. 

• Supports the implementation of technical artifacts (frameworks, standards, and repeatable patterns, etc.) that constitute the enterprise information security architecture and solutions and work with infrastructure teams to ensure adoption. 

• Contribute the creation of security policies, access controls, and authentication mechanisms based on data security and protection principles. 

• Manage the tactical execution of short- and long-term objectives through the coordination of activities with a direct responsibility for results, including costs, methods, and staffing.