SPM BISO

SAP•Burlington, MA

26d•$176,300 - $374,200•Hybrid

About The Position

This role supports the Sales Performance Management (SPM) organization in strengthening and advancing its overall security posture. The Business Information Security Officer (BISO) will serve as a senior security leader within the business, acting as the primary liaison between SAP Global Security Services (SGS) and the SPM Line of Business (LoB). The BISO operates as a deputy CISO within the business, owning and driving the end-to-end security strategy and execution. This individual will set the standard for integrity, accountability, inclusion, and leadership, while influencing and enabling teams across the organization to meet SAP’s security expectations. The BISO is accountable for the LoB’s overall security posture, orchestrating all security-related functions including Response Operations, Product/Application Security, Security Engineering, Security Enablement, and Security Risk Management. This role requires close collaboration with SGSC and active participation in the broader BISO network across SAP.

Requirements

10+ years of experience in information security, cybersecurity, or related technical domains, ideally within enterprise software or cloud environments
Proven track record in security leadership, governance, or program management roles, with ownership of security posture across a product, platform, or business unit
Strong familiarity with enterprise security frameworks (e.g., ISO 27001, NIST, SOC2) and experience driving compliance and risk management initiatives
Experience working within or alongside centralized security organizations (e.g., SGS or equivalent), with the ability to navigate complex, matrixed environments
Prior experience working in a global enterprise organization is strongly preferred
Deep understanding of application security, cloud security, and secure software development practices
Hands-on experience with vulnerability management, risk assessment, and remediation strategies
Strong knowledge of security architecture, threat modeling, and incident response processes
Familiarity with enterprise SaaS environments, distributed systems, and cloud platforms (e.g., AWS, Azure, GCP)
Ability to interpret and operationalize security policies, standards, and controls within a business context
Demonstrated ability to lead through influence across global, cross-functional teams without direct authority
High level of emotional intelligence (EQ) with strong stakeholder management and communication skills
Proven ability to translate complex security requirements into actionable business outcomes
Strong decision-making capability, with the ability to balance risk and business priorities
Experience enabling and developing high-performing teams or security communities of practice

Nice To Haves

Experience acting as a bridge between security teams and business stakeholders
Background in product security within SaaS or enterprise application environments
Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field (or equivalent experience)

Responsibilities

Drive the adoption and consumption of central security services delivered by SGSC, while supporting the execution of SAP’s security strategy, standards, and roadmap
Ensure and oversee the inventory and classification of systems, implementation of security controls, and ongoing risk analysis and remediation of vulnerabilities
Own and coordinate incident response activities, including decision-making authority and escalation as needed
Lead and empower security professionals within the LoB, acting as a multiplier and center of excellence to drive security awareness and compliance
Serve as a key stakeholder in the product release process, with authority to block releases in cases of non-compliance or security risk
Partner closely with LoB leadership, SGS, and central SAP teams to ensure alignment on security requirements and execution
Provide feedback and recommendations to enhance and evolve SAP’s overall security practices
Ensure proper escalation and reporting of security incidents in line with SAP policies and procedures