Director, Enterprise Security - Business Information Security Officer (BISO)

Salesforce•Indianapolis, IN

2d•$197,300 - $344,700•Hybrid

About The Position

Salesforce is hiring a Director, Business Information Security Officer (BISO), also called a Security Partner, to lead the security relationship and posture for assigned Enterprise Business Units. This senior technical leadership role serves as the primary link between those business units and the broader Enterprise Security organization. The Director reads and evaluates system designs and takes clear positions on architecture, controls, and trade-offs with engineers, product leaders, and executives. The role leads a small team of Security Partners and serves as the trusted security advisor to senior technical and business leaders. AI tools are used to scale analysis and drafting, allowing the role to focus on judgment and influence. The position is based in New York City, San Francisco, Denver, Indianapolis, Dallas, or McLean, and is eligible for a hybrid work arrangement. Applications will be accepted until February 28, 2027.

Requirements

12 or more years of experience in cybersecurity engineering, IT risk, or a closely related field, including experience in a large, complex enterprise.
Experience as a BISO, Security Partner, or similar senior security leader accountable for a business unit or product line.
Experience managing and developing security professionals and building high-performing teams.
Deep technical knowledge of cloud, identity, application security, and AI/ML risks, with the ability to contribute substantively to design reviews and threat models.
Knowledge of control frameworks such as COSO, NIST Cybersecurity Framework, and NIST SP 800-53, and regulations such as FedRAMP, SOX, and regional data-protection requirements.
Ability to prioritize risks clearly and explain what should be addressed now or deferred, with rationale that withstands executive scrutiny.
A record of measurably improving security in a business unit or product organization by closing findings, not merely reporting them.
Executive-level written and verbal communication skills, including communication with CISO, CIO, and Board audiences.
Sound judgment about when to decide, escalate, or hold the line, and comfort challenging senior leaders.
Ability to deliver in ambiguous, fast-moving environments and experience with change events such as mergers and acquisitions, reorganizations, and product launches.
Ability to turn data into leadership-ready narratives using reporting and analytics tools.
Ability to build trust with senior technical and business leaders across distributed, cross-functional teams.
Fluency with current AI coding and productivity tools.

Nice To Haves

CISSP, CISA, CISM, or equivalent certification.
Experience in regulated industries such as technology, financial services, public sector, or healthcare.
Experience integrating acquired entities or divestitures into enterprise security programs.
Bachelor’s degree in Computer Science, Engineering, Information Systems, Cyber Security, or a related field, or equivalent experience.

Responsibilities

Own the security relationship for an assigned business unit, representing the business unit within Enterprise Security and security within business-unit leadership.
Own the risk register, set severity and prioritization, sequence risk reduction while accounting for compensating controls, and route risk-acceptance decisions to the appropriate executive owner.
Build resourced risk-reduction plans with named owners and dates, hold teams accountable, and escalate stalled progress.
Lead security input on design reviews, threat models, and architecture decisions; shape the software development lifecycle, secure-by-design patterns, and platform guardrails early.
Deliver quarterly reviews, risk narratives, and posture metrics for Chief Information Security Officer, Chief Information Officer, and Board audiences.
Engage security engineers, the Cyber Security Operations Center, technical program managers, and other specialists at the appropriate time to drive enterprise-adopted outcomes.
Track emerging AI and machine-learning risks, including agentic architectures, prompt injection, and model and training-data governance, and translate them into risk and control decisions.
Incorporate compliance and regulatory requirements, including FedRAMP, SOX, and regional data-protection laws, into security risk prioritization in partnership with Legal, Privacy, and Compliance.
Drive adoption of security tooling, telemetry, and automation so risk decisions are data-informed.
Manage, coach, and develop Security Partner Leads and Senior Leads; establish operating cadence and deliverable standards, and develop successors.
Use approved AI assistants to produce executive-quality analysis and drafts and help the team do the same.
Partner with Enterprise Security leadership on cross-portfolio strategy and enterprise-wide programs.