Business Information Security Officer

Avnet•Tempe, AZ

About The Position

The Business Information Security Officer (BISO) is a business-facing cybersecurity leader who connects enterprise cybersecurity governance with Avnet’s global business units. The role aligns security, compliance, and risk management practices with enterprise IT strategy while accounting for the operational needs of each business segment. It translates cybersecurity policies, risk posture, and strategic priorities into practical guidance that supports business decisions, revenue growth, and risk reduction. The BISO provides embedded security leadership across business units, helping assess systems and select appropriate controls, communicate risks in business terms, improve risk visibility, and drive remediation. The position also supports vulnerability management, secure configuration baselines, customer-facing security discussions, and certification and regulatory compliance activities. The role helps ensure security investments and practices are consistent, actionable, and aligned with business priorities.

Requirements

Typically 8+ years of work experience with a bachelor’s degree or equivalent.
Bachelor’s degree or equivalent experience providing comparable knowledge and job skills.
Ability to communicate effectively with senior business leaders, including business unit presidents.
Ability to translate technical concepts into clear, business-relevant insights.
Ability to influence without formal authority through credibility, clarity, and trust.
Ability to frame risk in terms of financial, operational, regulatory, and reputational impact.
Strong understanding of cybersecurity frameworks, governance, and risk management.
Proficiency in system assessment, control selection, and vulnerability management practices.
Ability to balance enterprise standards with local business needs.
Experience supporting compliance programs and audit processes.

Nice To Haves

May require competency in Security Intelligence, Identity Management, Compliance, Secured Infrastructure, Secured Development, and Security Education.

Responsibilities

Serve as the primary point of contact for business units’ security needs; consolidate, triage, and prioritize security requests, projects, and operational issues.
Ensure business areas receive consistent, equitable, and timely security support.
Apply standardized methodologies to assess system risk and recommend appropriately sized security controls based on operational context and regulatory requirements.
Translate technical risks into business-impact language for executives, including operational, financial, customer-trust, and compliance impacts.
Develop corrective action plans, compensating controls, and risk acceptances for vulnerabilities, supplier risks, audit findings, and system gaps.
Establish recurring governance touchpoints within business units and provide visibility into security posture, risk areas, and upcoming compliance obligations.
Drive accountability for remediation and adherence to enterprise security guardrails.
Escalate business-unit-specific risks and needs to enterprise cybersecurity leadership.
Support business units in meeting vulnerability remediation SLAs and coordinate remediation with IT Operations and Engineering.
Promote and monitor adoption of secure configuration baselines across systems.
Provide security expertise to customer-facing functions, including supply chain solutions, design services, and digital platforms.
Support sales cycles, customer trust discussions, and contract and audit responses; communicate cybersecurity investments as differentiators for revenue-critical offerings.
Guide business units through security and compliance certifications, including control implementation, evidence collection, readiness assessments, and audit interactions.
Assist with ongoing regulatory and compliance requirements, including SOX, PCI, HIPAA, GDPR, and regional or industry-specific mandates.
Translate certification and regulatory obligations into business tasks and track gaps through remediation plans or risk acceptances.
Help reduce risk from siloed or business-managed IT, encourage consistent cybersecurity policy and control adoption, improve vulnerability management and secure baseline consistency, and align security investments with business priorities and budget governance.