Business Information Security Officer

Avnet•Chandler, AZ

About The Position

The Business Information Security Officer (BISO) is a business-facing cybersecurity leader who connects enterprise cybersecurity governance with Avnet’s global business units. The role translates security policies, risk posture, and strategic priorities into practical guidance that supports business decisions, operational needs, revenue growth, and risk reduction. The BISO provides consistent security support across business areas, assesses system risk and recommends appropriate controls, communicates technical risk in business terms, and develops plans for remediation or risk acceptance. The role establishes local governance and risk visibility, escalates business-specific needs to enterprise cybersecurity leadership, supports vulnerability remediation and secure configuration baselines, and represents security interests in customer-facing and revenue activities. The position also supports security certifications and regulatory compliance by guiding control implementation, evidence collection, readiness assessments, and audit interactions. It helps translate obligations into actionable tasks and tracks gaps through structured remediation plans or risk acceptances. The role’s overall purpose is to strengthen security consistency, risk visibility, remediation, and alignment between enterprise IT direction and business priorities.

Requirements

Typically 8 or more years of work experience with a bachelor’s degree or equivalent.
Bachelor’s degree or equivalent experience providing comparable knowledge and job skills.
Ability to communicate effectively with senior business leaders, including business-unit presidents.
Ability to translate technical concepts into clear, business-relevant insights.
Ability to influence without relying on authority, using credibility, clarity, and trust.
Ability to frame risk in terms of financial, operational, regulatory, and reputational impact.
Strong understanding of cybersecurity frameworks, governance, and risk management.
Proficiency in system assessment, control selection, and vulnerability management practices.
Ability to balance enterprise standards with local business needs.
Experience supporting compliance programs and audit processes.

Nice To Haves

May require competency in all six Security competencies: Security Intelligence, Identity Management, Compliance, Secured Infrastructure, Secured Development, and Security Education.

Responsibilities

Serve as the primary point of contact for each business unit’s security needs.
Consolidate, triage, and prioritize security requests, projects, and operational issues, ensuring consistent, equitable, and timely support.
Apply standardized methodologies to assess system risk and recommend appropriately scaled security controls based on operational context and regulatory requirements.
Translate technical risks into clear business impacts, including operational disruption, financial exposure, customer trust, and compliance.
Develop corrective action plans, compensating controls, and risk acceptances for vulnerabilities, supplier risks, audit findings, and system gaps.
Establish recurring governance touchpoints within business units and provide visibility into security posture, risk hot spots, and upcoming compliance obligations.
Drive accountability for remediation and adherence to enterprise security guardrails.
Escalate business-unit-specific risks and needs to enterprise cybersecurity leadership.
Support business units in meeting vulnerability remediation SLAs and coordinate remediation with IT Operations and Engineering.
Promote and monitor adoption of secure configuration baselines across systems.
Provide security expertise to customer-facing functions, including supply chain solutions, design services, and digital platforms.
Support sales cycles, customer trust discussions, and contract and audit responses; position cybersecurity investments as competitive differentiators.
Support security and compliance certifications, including CMMC, ISO 27001, UK Cyber Essentials, and NIS2, by guiding control implementation, evidence collection, readiness assessments, and audit interactions.
Assist business units in meeting regulatory and compliance requirements such as SOX, PCI, HIPAA, GDPR, and other regional or industry-specific mandates.
Translate certification and regulatory obligations into actionable business tasks and track gaps through remediation plans or risk acceptances.
Align security investments with business priorities and budget governance.