Director, Business Information Security Officer (BISO)

ABM US•Cumming, GA

4d•$176,505 - $240,000•Hybrid

About The Position

ABM is seeking a strategic, business-focused Cybersecurity Director, Business Information Security Officer (BISO) within its Information Security organization. Reporting directly to the SVP and CISO, the BISO serves as the primary cybersecurity advisor to business and corporate leaders, bridging cybersecurity strategy, technology risk, resilience, and business operations while enabling growth and innovation. The role translates complex security issues into practical business decisions and embeds security, privacy, resilience, and risk-management principles into business strategies, projects, processes, applications, infrastructure, and emerging-technology initiatives. The BISO partners with business leaders, technology teams, project managers, Legal and Compliance teams, third parties, and subject matter experts to identify and manage risk across the business and technology lifecycle. This is an in-office role requiring work on-site four days per week. Occasional travel, extended hours, or participation in incident response and resilience activities may be required based on business needs.

Requirements

Bachelor's degree or equivalent experience.
Twelve or more years of experience in cybersecurity, technology risk, information security, or related disciplines.
At least five years of experience in an operationally focused cybersecurity, information risk, technology risk, or information security role.
Experience advising senior business and technology leaders.
Demonstrated experience developing or managing business impact analyses, business continuity plans, disaster recovery plans, cyber recovery plans, resilience strategies, or related testing programs.
Experience translating business requirements and operational priorities into cybersecurity, technology risk, and resilience requirements.
Experience leading cyber risk, governance, security, or resilience programs in a complex organization.
Strong understanding of cloud security, IAM, data protection, security architecture, and risk management.
Familiarity with applicable legal, regulatory, and industry requirements, including SOX, HIPAA, CPRA, GDPR, and other relevant privacy and security requirements.
Knowledge of recognized cybersecurity and risk-management frameworks, such as NIST Cybersecurity Framework, NIST 800-53, ISO 27001, COBIT, CIS Controls, or similar frameworks.

Nice To Haves

Master's degree in business, computer science, information security, information systems, risk management, or a related field.
CISSP, CISM, CRISC, CISA, CCSP, CGEIT, CBCP, MBCI, ITIL, GIAC, or similar certifications.
Experience supporting artificial intelligence (AI), machine learning (ML), automation, robotics, robotic process automation, or other emerging-technology risk initiatives.
Experience working with facility services, engineering, infrastructure, aviation, manufacturing, logistics, education, healthcare, or other operationally complex environments.
Experience with GRC platforms, business continuity management systems, risk-management tools, security metrics, and reporting dashboards.
Familiarity with third-party resilience assessments, supply-chain risk, concentration risk, and critical-service dependency mapping.

Responsibilities

Serve as the primary cybersecurity advisor to business and corporate leadership.
Align cyber risk management with business priorities and operational objectives.
Embed security, privacy, and resilience requirements into projects, applications, and technology solutions.
Lead business continuity, disaster recovery, cyber recovery, and resilience planning efforts.
Translate cybersecurity risks and metrics into actionable business insights for executives.
Advise on AI, cloud, automation, and emerging technology risks and governance.
Partner with Legal, Compliance, Privacy, Internal Audit, Enterprise Risk, and Technology teams.
Champion a strong enterprise-wide culture of security awareness and accountability.