Enterprise Security BISO - Director

Salesforce•San Francisco, CA

About The Position

The Business Information Security Officer - Director role is part of our Enterprise Security Team. This role will act as a pivotal liaison between the Enterprise Security team and technology business units, ensuring alignment of security controls, policies, and strategies with organizational goals. To drive reduction of risk throughout the enterprise, this role requires both a strategic lens, as well as an engineering mindset, including technical knowledge in secure development and architecture. As an individual contributor, the BISO will drive security initiatives, ensure foundational control compliance, influence strategic investment opportunities and policy changes, and provide strategic guidance to their assigned business units.

Requirements

Education : Bachelor’s degree in Computer Science, Information Security, or a related field;
Experience : 10+ years in cybersecurity, including at least 5 years advising on technical security outcomes in business-aligned contexts with at least 5 years in a senior-level role focusing on business-aligned security strategy. Proven experience as an individual contributor in a high-impact, leadership role within a complex enterprise environment.
Deep understanding of security principles across all tech layers, including cloud platforms (AWS, Azure, GCP), infrastructure security (network, endpoint, IAM), application security (SAST, DAST, secure coding), and third-party risk management frameworks.
Deep technical expertise applying security principles across all tech layers, including cloud security (AWS, Azure, GCP), network security, encryption protocols (e.g., TLS, AES), and identity and access management (IAM) solutions through practical advisory engagements and understanding security principles across the corresponding infrastructure, including cloud security (AWS, Azure, GCP), network security, encryption protocols (e.g., TLS, AES), and identity and access management (IAM) solutions.
Proven understanding of security and compliance frameworks (e.g. NIST CSF, ISO 270001/2, etc)
Technical Skills : Hands on experience performing threat modeling and providing guidance around technical security controls such as authentication, RBAC, and data protection.
Proficiency with security tools such as SIEM (e.g., Splunk, QRadar), EDR (e.g., CrowdStrike, SentinelOne), IAM Solutions (Okta, Sailpoint), and vulnerability management platforms (e.g., Qualys, Tenable).
Strong understanding of secure software development lifecycle (SDLC) and DevSecOps practices to guide integration of SAST/DAST scans into pipelines, collaborating on remediation workflows .
Experience with zero trust architecture and multi-factor authentication (MFA) implementations.
Familiarity with advanced security technologies such as container security, microservices security, cryptography and AI/ML security applications to assess risks like prompt injection in models or encrypted data flows.
Process and Relationship Skills : Exceptional ability to translate complex technical concepts into business-friendly language for non-technical stakeholders.
Strong project management skills, with experience leading cross-functional initiatives.
Proven track record of building trusted relationships with C-suite executives, business unit leaders, and technical teams through advisory support during high-stakes security incidents.
Strong executive presence and the ability to articulate technical security concepts in a business/risk context.
Proven experience influencing stakeholders to invest in strategic security initiatives to buy down risk.
Excellent communication and presentation skills, with the ability to influence and drive consensus across diverse groups.
Industry Knowledge : Deep understanding of current cybersecurity trends, threat landscapes, and regulatory requirements specific to the technology industry to inform proactive advisory on emerging risks like supply chain vulnerabilities.

Nice To Haves

Certifications : CISSP, CCSP, CISM, CRISC, CISA, or equivalent certifications are highly desirable.
Strategic thinker with a proactive, risk-based approach to cybersecurity.
Ability to work independently, prioritize tasks, and deliver results in a fast-paced environment.
Strong problem-solving skills and a passion for staying ahead of evolving cyber threats.
Experience in a regulated industry with a focus on compliance and governance, mapping controls to technical advisory outputs.
Experience managing risk across AI and SaaS ecosystems.

Responsibilities

Strategic Security Alignment: Partner with business units to integrate cybersecurity strategies into business processes, ensuring alignment with organizational objectives and risk tolerance through secure-by-design integration. Embed security into business unit roadmaps by reviewing PRDs, architectural diagrams and CI/CD pipelines in real time; reject weak patterns (i.e. default-deny not enforced, secrets in code).
Risk Management and Compliance: Conduct technology tier 3 risk assessments, identify security control gaps, and develop mitigation strategies in alignment with industry standards. Manage stakeholder expectations and cybersecurity risk for the Business units.
Security Architecture Oversight: Provide technical guidance on secure development patterns. For example, basic guidance understanding of firewalls, intrusion detection/prevention systems (IDS/IPS), SDLC, threat modeling, secure authentication and authorization and endpoint detection and response (EDR), and security information and event management (SIEM) systems. . Embed security into business unit roadmaps by reviewing PRDs, architectural diagrams and CI/CD pipelines in real time, rejecting weak patterns (i.e. default-deny not enforced, secrets in code).
Policy Development and Governance: Refine, and enforce security policies, standards, and procedures, which are applicable to the enterprise environment, ensuring compliance with regulations and emerging risks. Own risk evaluation of security policy exceptions within the assigned BUs.
Strategic Security Remediation Risk Prioritization: Lead the coordination of security remediation efforts for business units, through a risk register which helps prioritize all work (bugs, transformational initiatives, compliance findings, etc) during sprint planning.
Stakeholder Relationship Management: Build and maintain strong relationships with business leaders, IT teams, and external partners to foster a culture of security awareness and collaboration. Influence strategic security investment decision-making without direct authority and work effectively across different teams and at all levels.Influence leadership when strategic investments are needed.
Security Awareness and Training: Develop and deliver tailored security awareness programs for business units as applicable, promoting best practices in areas such as phishing prevention and secure data handling, when needed.
Security Posture Analytics: Create dashboards for KPIs and KRIs that highlight actionable insights (e.g., vulnerability trends triggering automated alerts), presenting to leadership to inform business unit wide security improvements.
Metrics and Reporting: Develop and present key performance indicators (KPIs) and key risk indicators (KRIs) to senior leadership, providing insights into the organization’s security posture.