Principal Information Security - Identity and Data Security

BILL•San Jose, CA

1d•$206,700 - $304,000•Remote

About The Position

As part of our Identity and Data Security team, you will be accountable for the strategy, security, and governance of digital identities—both human (employees, contractors, business partners) and non-human (agents, bots, service accounts, IoT). In addition, this role will oversee and coordinate BILL’s governance, risk, compliance (GRC), and remediation activities related to data security. This position will report directly to the Security GRC Leader. This role addresses all aspects of administration, enforcement, compliance, education, investigation, and contingency planning related to identity and data security, aligning with stakeholders in IT, Privacy Legal, Internal Audit, and Engineering teams to ensure BILL’s rigorous data control standards are met. This role is a hands-on IC security leader role with the expectation that work will vary between strategic and operational.

Requirements

Bachelor’s degree in cyber security (or) related degree or equivalent work experience
10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps
Proven track record of scaling GRC, identity, and/or data security programs.
Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)

Nice To Haves

Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred

Responsibilities

Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.
Implement measures and governance frameworks to manage data use in compliance with laws and regulations
Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed
Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities
Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.
Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.
Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.
Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.
Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability.
Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases.
Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.