Information Security Lead

Boa Technology•Denver, CO

6h•Hybrid

About The Position

BOA® Technology builds the patented BOA® Fit System and partners with leading brands to improve the fit and performance of athletic equipment. The company is headquartered in Denver, Colorado, with offices in Austria, Hong Kong, Greater China, South Korea, and Japan. Reporting to the Director of Business Systems and IT, the Information Security Lead coordinates and advances BOA’s global cybersecurity program, primarily focusing on information systems governance, risk, and compliance (GRC), as well as day-to-day security operations. Working with IT Operations and Business Systems Analysts, the role supports the development and execution of the security roadmap, maintains policies and controls, coordinates assessments and audits, tracks risks, and drives remediation. The position combines security program coordination with hands-on operational work, including triaging alerts, supporting incident response, facilitating access reviews, managing vulnerability remediation, and delivering employee security awareness initiatives. The role is based within a flexible working approach. Most of the Denver team uses a hybrid arrangement, with remote work and in-office connection days on Tuesdays and Thursdays; some roles may require four to five office days per week depending on job-specific needs. The role regularly involves working in an office environment, mostly sitting and using standard office equipment.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience.
At least 5 years of professional experience in information security, IT risk management, or IT operations with significant security responsibilities.
Practical experience applying recognized security frameworks such as NIST CSF 2.0, CIS Controls, or ISO/IEC 27001 to risk assessments, policies, controls, and program improvement.
Working knowledge of Windows, macOS, and Linux environments.
Working knowledge of Microsoft security and identity technologies, including Microsoft 365, Azure, Active Directory, Microsoft Entra ID, Intune, and Microsoft Defender.
Hands-on proficiency in monitoring and triaging security alerts, investigating potential threats, and initiating appropriate incident response actions.
Solid understanding of networking, identity and access management, and on-premises and cloud infrastructure security fundamentals.
Strong communication, organizational, and analytical skills, with the ability to coordinate security initiatives across technical teams, departments, and third parties.

Nice To Haves

Relevant industry certifications, such as CompTIA Security+, CISSP, CISM, or CRISC.
Experience improving security monitoring, incident response, tabletop exercises, or business continuity and disaster recovery readiness.
Experience coordinating security or compliance audits, preparing control evidence, performing access reviews, or supporting SOX ITGC activities.
Experience in a global, multi-site manufacturing, distribution, or consumer products organization.

Responsibilities

Reflect and role model BOA’s vision, values, and Leadership Model, and demonstrate passion for the mission across the IT team and organization.
Support the development and execution of BOA’s information security strategy and multi-year roadmap in partnership with the Director of Business Systems and IT.
Assess security program maturity using NIST CSF 2.0; coordinate annual independent security assessments and audits; document, prioritize, and track findings through remediation closure.
Develop and maintain enterprise security policies, standards, and procedures; manage the information security risk register, risk management plans, and documented exception process across global operations.
Oversee identity and access governance, including periodic user access reviews, privileged access oversight, and segregation of duties, providing an independent control-review perspective.
Serve as the primary information security contact for internal and external auditors; coordinate control evidence and support SOX ITGC testing and remediation.
Manage third-party cyber risk through vendor assessments, reviews of vendor security reports and other assurance materials, and follow-up on identified gaps.
Lead global security awareness initiatives, including phishing simulations and practical guidance on social engineering, data protection, and secure use of software systems and tools.
Lead vulnerability management by evaluating exposure and business impact, establishing remediation priorities and timelines, coordinating with IT Operations, and verifying corrective actions.
Oversee security monitoring coverage and investigate or triage security alerts, events, and tickets; collaborate with external security service providers and internal technical teams as needed.
Maintain and exercise incident response procedures; coordinate investigations, escalation, containment, recovery, and lessons learned.
Partner with IT Operations on disaster recovery exercises and resilience testing.
Define and report security metrics, control effectiveness, program progress, and material risks to IT and company leadership; advise on security requirements for technology and business initiatives.
Monitor relevant cyber threats, regulatory developments, and security practices; recommend pragmatic improvements suited to BOA’s risk profile.

Benefits

10% annual bonus eligibility.
Comprehensive medical, dental, and vision plans, with BOA subsidies; one plan option is 100% subsidized by BOA.
BOA-funded HSA accounts for enrolled employees.
Three weeks of PTO to start, paid family leave, sick leave, and volunteer time off.
Matching 401(k) retirement plan.
Annual cash benefits for fitness, wellness, and BOA products.
Eligibility for stock options within six months of employment.
Scholarship opportunities for further education.
Flexible working schedule with days at home and in the office as needed.
Learning and development opportunities.
Discounts on many outdoor gear brands.
Dog-friendly office.