Vice President - Information Security & Compliance

BI WORLDWIDE seeks a strategic leader to direct enterprise information security, IT compliance, and AI governance. As our senior-most security and compliance leader, this person owns the company's security vision, cyber risk posture, regulatory and contractual compliance, and the assurance programs our clients rely on.

This leader operates at the intersection of technology, risk, and trust. They advise the senior leadership team and board, represent BI WORLDWIDE to clients and auditors, and mobilize teams across the company. They bring deep, current expertise in Microsoft 365 and AWS, and they convert strategy into measurable risk reduction and sustained compliance.

Responsibilities

Strategy and leadership

• Set and execute a multi-year information security and compliance strategy aligned with business objectives, client commitments, and enterprise risk appetite.
• Serve as the leader accountable for information security and IT compliance, advising the senior leadership team and board on cyber risk, regulatory exposure, and program investment.
• Build and lead a high-performing organization spanning security architecture and engineering, security operations, identity and access management, governance, risk and compliance (GRC), and awareness.
• Own the security and compliance budget, technology portfolio, and strategic partners, including MSSP/MDR providers; rationalize tools and demonstrate return on investment.
• Report program maturity, risk posture, and compliance status to senior leadership through clear metrics and KPIs.

Governance, risk, and compliance

• Own the enterprise information security and IT compliance program, including the policy framework, control library, and compliance calendar.
• Direct attestation and certification programs such as SOC 1 and SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and ISO/IEC 42001, and own audit readiness, evidence management, and remediation.
• Lead cyber risk management: identify, quantify, and prioritize risk in business terms, maintain the risk register, and drive remediation to closure.
• Partner with Legal and Privacy to meet global privacy and data protection obligations, including GDPR, CCPA/CPRA, and other U.S. state and international privacy laws.
• Monitor emerging regulations and client requirements, assess their impact, and adapt controls ahead of new obligations.
• Implement continuous control monitoring and a GRC platform that gives leaders real-time visibility into compliance posture.
• Govern third-party and vendor risk, from due diligence and contract terms through ongoing monitoring.
• Act as the primary point of accountability to Internal Audit, external auditors, and regulators for information security and IT compliance.

Security architecture and operations

• Direct security for the Microsoft 365 ecosystem, including Entra ID, Conditional Access, Intune, Defender XDR, Purview data protection and DLP, and Sentinel.
• Direct security for the AWS environment, including multi-account governance (Organizations, Control Tower, SCPs), IAM and least privilege, network security, encryption and key management, logging and detection (CloudTrail, GuardDuty, Security Hub), and cloud security posture management.

• Direct security for the broader SaaS portfolio beyond Microsoft, such as Salesforce, Workday, and ServiceNow, including SaaS security posture management (SSPM), configuration baselines, third-party app and OAuth governance, shadow IT discovery, and secure SaaS-to-SaaS integrations.

• Advance a Zero Trust architecture across identity, endpoints, networks, data, applications, and cloud workloads.
• Oversee security operations, threat detection, vulnerability management, and penetration testing.
• Lead incident response and crisis management, including tabletop exercises, leadership and client communications, regulatory notifications, and coordination with Legal, insurers, and law enforcement.
• Embed secure-by-design practices into the software development lifecycle and CI/CD pipelines in partnership with engineering and product leaders.
• Align business continuity and disaster recovery programs with IT and business leaders.

AI governance and security

• Establish and co-lead the company's AI governance program with Legal, Privacy, Data, and Engineering, covering acceptable use, AI risk assessments, an approved tool and model inventory, and AI vendor oversight.
• Secure enterprise and client-facing AI, including Microsoft 365 Copilot data governance, Amazon Bedrock and other AWS AI services, and defenses against prompt injection, data leakage, model misuse, and shadow AI.

Client trust and culture

• Represent BI WORLDWIDE in client security and compliance reviews, RFPs, contract negotiations, and leadership briefings, and position security as a competitive differentiator.
• Build a culture of security and compliance through engaging training, phishing simulations, and clear, approachable communication with employees at every level.

Role Scope

This leader owns information security and IT compliance across BI WORLDWIDE: strategy, governance, risk, assurance, and the protection of our corporate, infrastructure, and client-facing environments. The Vice President sets direction, makes risk-based decisions, and answers for the program's outcomes.

We expect this leader to remain technically fluent, engage directly in architecture and incident decisions, and earn engineers' respect through real depth in Microsoft 365 and AWS. The scope spans corporate IT, identity, endpoints, collaboration platforms, cloud infrastructure, client platforms, and the company's use of AI. This leader partners closely with Legal, Privacy, Internal Audit, Engineering, Infrastructure, Data, and business leaders.

What We Are Looking For

Security and compliance leadership

• 15+ years of progressive experience in information security, risk, and compliance, including 7+ years leading security teams and 3+ years as an organization's senior-most security leader or as that person's deputy.
• A proven record of building or maturing an enterprise security and compliance program, with measurable gains in risk posture and program maturity.
• A track record of achieving and sustaining SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 42001, or comparable attestations and certifications.
• Experience presenting to executives, customers, and audit and risk committees and translating technical risk into business impact.
• Experience managing a security and compliance budget, a multidisciplinary team, and strategic MSSP/MDR partners.

Deep technical foundation

• Current, hands-on depth securing Microsoft 365: Entra ID, Conditional Access, Intune, Defender XDR, Purview, and Sentinel.
• Current, hands-on depth securing AWS at scale: multi-account architecture, IAM, network controls, encryption/KMS, CloudTrail, GuardDuty, Security Hub, and infrastructure-as-code guardrails.
• Experience securing enterprise AI, including Microsoft 365 Copilot readiness (permissions, sensitivity labels, DLP), AWS AI services such as Amazon Bedrock, and the AI threats that the OWASP Top 10 for LLM Applications and MITRE ATLAS describe.
• Strong command of identity and access management, Zero Trust, endpoint and network security, data protection, application security, and detection and response.
• Experience leading incidents from detection through recovery, regulatory notification, and post-incident review.

Governance, risk, and compliance

• Deep knowledge of NIST CSF, NIST SP 800-53, CIS Controls, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 1 and SOC 2.
• Working knowledge of global privacy regulation, including GDPR, CCPA/CPRA, and U.S. state privacy laws, and experience partnering with Legal and Privacy on compliance.
• Experience building an AI governance program, with knowledge of the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, and U.S. state AI laws.
• Experience implementing a GRC platform and continuous control monitoring.
• Experience leading external audits and client security assessments, including client questions about how the company uses AI with their data.

Leadership presence and communication

• Credibility with the executives, leadership, employees at every level, and customers.
• The ability to distill complex security and regulatory topics into clear decisions for technical and non-technical audiences.
• A business-enabling mindset that finds the secure, compliant path to yes.
• Experience representing security and compliance directly to clients in sales cycles, contract negotiations, and leadership briefings.

Education

• Bachelor's degree in computer science, information security, or a related field, or equivalent experience. A master's degree (MS, MBA) is a plus.

Preferred Experience

Experience in one or more of the following areas strengthens a candidacy:

• Security and audit certifications such as CISSP, CISM, CRISC, CISA, CCSP, AWS Certified Security -- Specialty, or Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• Privacy and AI governance credentials such as CIPP/US, CIPM, or the IAPP Artificial Intelligence Governance Professional (AIGP).
• Security and compliance leadership in a client-services, marketing, incentives, or SaaS company that handles client and consumer data.
• Securing multi-tenant, client-facing platforms and payment-related workflows.
• Service on an enterprise AI or risk steering committee.
• DevSecOps, CI/CD pipeline security, and container and Kubernetes security.
• Data and analytics platform security, such as Databricks.
• Cyber insurance, regulatory reporting, and crisis communications.

Base Salary Range: $230,000 to $270,000. The final salary and offer will be determined by the applicant's background, experience, and skills. This role is also eligible for an annual incentive bonus.

More details about our company benefits can be found at the following link: https://www.biworldwide.com/careers/benefits-page/