Business Information Security Officer

Conti LLC•Sterling Heights, MI

About The Position

The Business Information Security Officer (BISO) for Operational Technology (OT) and customer-facing solutions serves as the primary security liaison between the cybersecurity organization and business units responsible for OT environments and externally delivered solutions. The role owns the security program for these domains, supporting secure onboarding of systems and partners, maintaining documentation standards, participating in design and architecture reviews, and leading security assessments for OT networks and customer-facing solutions. This cross-functional position requires technical security knowledge, stakeholder communication skills, and understanding of industrial control systems (ICS) and enterprise solution delivery. The BISO ensures that security is embedded in processes from initial design through ongoing operations after delivery. The position reports to the NORAM Chief Information Security Officer (CISO) and is located in Sterling Heights, Michigan, or Montreal, Canada.

Requirements

At least 7 years of experience in information security, including at least 3 years focused on OT/ICS security or customer-facing solution security in a solutions provider or managed services context.
Demonstrated experience conducting security design reviews, architecture assessments, and risk analysis for complex networked environments.
Working knowledge of OT/ICS security standards and frameworks.
Familiarity with enterprise IT security frameworks.
Experience managing security documentation programs.
Strong understanding of network security principles, including segmentation, DMZ design, firewall policy, remote access, and identity and access management.
Excellent verbal and written communication skills, with the ability to present security risk to technical and non-technical audiences.

Nice To Haves

CISSP, CISM, GICSP, or equivalent certification.
Direct experience with DCS, PLCs, historians, or industrial IoT networks.
Experience working alongside regulated industries such as energy/utilities or manufacturing.
Background in solutions delivery or managed security services.
Experience with security tooling relevant to OT and enterprise environments.
Familiarity with secure remote-access solution implementations and designs.

Responsibilities

Lead security onboarding for new OT systems and customer-facing solutions, ensuring assets are assessed, documented, and approved before production deployment.
Define and enforce security requirements, including network segmentation standards, access-control models, and identity-management policies for OT and customer solution environments.
Coordinate with procurement, legal, and IT teams to ensure third-party vendors meet security baseline requirements through contract review and vendor risk assessments.
Own the security documentation library for OT and customer-facing solution domains, including network diagrams, network flows, security control matrices, security plans, and backup solutions.
Develop and maintain security standards and procedures specific to OT environments.
Keep documentation current through periodic review cycles and align it with applicable compliance frameworks.
Collaborate with engineering, operations, and product teams to capture security architecture decisions and maintain accurate as-built documentation.
Participate as a security subject-matter expert in architecture design reviews.
Review proposed OT system architectures, network designs, and customer solution designs for security gaps, providing documented findings and remediation recommendations.
Lead security reviews for OT network changes, new customer-facing solutions, and significant modifications to existing deployments; produce risk assessment reports with prioritized findings.
Coordinate penetration testing and vulnerability assessment activities for OT and customer solution environments, and track findings through remediation.
Assess and communicate residual risk to business stakeholders and the CISO, facilitating informed risk acceptance decisions when appropriate.
Serve as the security point of contact for customer security questionnaires, audits, and third-party security assessments related to delivered solutions.