Vice President - Information Security & Compliance

BI WORLDWIDE•Edina, MN

8d•$230,000 - $270,000

About The Position

BI WORLDWIDE seeks a strategic leader to direct enterprise information security, IT compliance, and AI governance. As the company's senior-most security and compliance leader, this person owns the security vision, cyber risk posture, regulatory and contractual compliance, and assurance programs relied on by clients. The leader operates across technology, risk, and trust, advising senior leadership and the board, representing BI WORLDWIDE to clients and auditors, and mobilizing teams throughout the company. The role requires current technical depth in Microsoft 365 and AWS and the ability to turn strategy into measurable risk reduction and sustained compliance. The position owns information security and IT compliance across BI WORLDWIDE, including strategy, governance, risk, assurance, and protection of corporate, infrastructure, and client-facing environments. The Vice President sets direction, makes risk-based decisions, and is accountable for program outcomes. The scope spans corporate IT, identity, endpoints, collaboration platforms, cloud infrastructure, client platforms, and AI use. The leader partners closely with Legal, Privacy, Internal Audit, Engineering, Infrastructure, Data, and business leaders.

Requirements

15+ years of progressive experience in information security, risk, and compliance, including 7+ years leading security teams and 3+ years as an organization's senior-most security leader or that person's deputy.
A proven record of building or maturing an enterprise security and compliance program with measurable improvements in risk posture and program maturity.
A track record of achieving and sustaining SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 42001, or comparable attestations and certifications.
Experience presenting to executives, customers, and audit and risk committees and translating technical risk into business impact.
Experience managing a security and compliance budget, a multidisciplinary team, and strategic MSSP/MDR partners.
Current, hands-on depth securing Microsoft 365, including Entra ID, Conditional Access, Intune, Defender XDR, Purview, and Sentinel.
Current, hands-on depth securing AWS at scale, including multi-account architecture, IAM, network controls, encryption/KMS, CloudTrail, GuardDuty, Security Hub, and infrastructure-as-code guardrails.
Experience securing enterprise AI, including Microsoft 365 Copilot readiness, AWS AI services such as Amazon Bedrock, and AI threats described by the OWASP Top 10 for LLM Applications and MITRE ATLAS.
Strong command of identity and access management, Zero Trust, endpoint and network security, data protection, application security, and detection and response.
Experience leading incidents from detection through recovery, regulatory notification, and post-incident review.
Deep knowledge of NIST CSF, NIST SP 800-53, CIS Controls, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 1 and SOC 2.
Working knowledge of global privacy regulation, including GDPR, CCPA/CPRA, and U.S. state privacy laws, and experience partnering with Legal and Privacy on compliance.
Experience building an AI governance program, with knowledge of the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, and U.S. state AI laws.
Experience implementing a GRC platform and continuous control monitoring.
Experience leading external audits and client security assessments, including questions about how the company uses AI with client data.
Credibility with executives, leaders, employees at every level, and customers.
Ability to distill complex security and regulatory topics into clear decisions for technical and non-technical audiences.
A business-enabling mindset that finds the secure, compliant path to yes.
Experience representing security and compliance directly to clients in sales cycles, contract negotiations, and leadership briefings.
Bachelor's degree in computer science, information security, or a related field, or equivalent experience.

Nice To Haves

A master's degree (MS, MBA).
Security and audit certifications such as CISSP, CISM, CRISC, CISA, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Cybersecurity Architect Expert (SC-100).
Privacy and AI governance credentials such as CIPP/US, CIPM, or the IAPP Artificial Intelligence Governance Professional (AIGP).
Security and compliance leadership in a client-services, marketing, incentives, or SaaS company handling client and consumer data.
Experience securing multi-tenant, client-facing platforms and payment-related workflows.
Service on an enterprise AI or risk steering committee.
Experience with DevSecOps, CI/CD pipeline security, and container and Kubernetes security.
Data and analytics platform security experience, such as Databricks.
Experience with cyber insurance, regulatory reporting, and crisis communications.

Responsibilities

Set and execute a multi-year information security and compliance strategy aligned with business objectives, client commitments, and enterprise risk appetite.
Lead information security and IT compliance, advising senior leadership and the board on cyber risk, regulatory exposure, and program investment.
Build and lead teams across security architecture and engineering, security operations, identity and access management, governance, risk and compliance, and awareness.
Own the security and compliance budget, technology portfolio, and strategic partners, including MSSP/MDR providers; rationalize tools and demonstrate return on investment.
Report program maturity, risk posture, and compliance status to senior leadership using clear metrics and KPIs.
Own the enterprise information security and IT compliance program, including its policy framework, control library, and compliance calendar.
Direct attestation and certification programs, including SOC 1 and SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and ISO/IEC 42001; oversee audit readiness, evidence management, and remediation.
Lead cyber risk management by identifying, quantifying, and prioritizing risk in business terms, maintaining the risk register, and driving remediation to closure.
Partner with Legal and Privacy to meet global privacy and data protection obligations, including GDPR, CCPA/CPRA, and other U.S. state and international privacy laws.
Monitor emerging regulations and client requirements, assess their impact, and adapt controls ahead of new obligations.
Implement continuous control monitoring and a GRC platform that provides leaders with real-time visibility into compliance posture.
Govern third-party and vendor risk, from due diligence and contract terms through ongoing monitoring.
Serve as the primary point of accountability to Internal Audit, external auditors, and regulators for information security and IT compliance.
Direct security for Microsoft 365, including Entra ID, Conditional Access, Intune, Defender XDR, Purview data protection and DLP, and Sentinel.
Direct AWS security, including multi-account governance, IAM and least privilege, network security, encryption and key management, logging and detection, and cloud security posture management.
Direct security for the broader SaaS portfolio, including Salesforce, Workday, and ServiceNow, with SSPM, configuration baselines, third-party app and OAuth governance, shadow IT discovery, and secure SaaS-to-SaaS integrations.
Advance a Zero Trust architecture across identity, endpoints, networks, data, applications, and cloud workloads.
Oversee security operations, threat detection, vulnerability management, and penetration testing.
Lead incident response and crisis management, including tabletop exercises, leadership and client communications, regulatory notifications, and coordination with Legal, insurers, and law enforcement.
Embed secure-by-design practices into the software development lifecycle and CI/CD pipelines with engineering and product leaders.
Align business continuity and disaster recovery programs with IT and business leaders.
Establish and co-lead the AI governance program with Legal, Privacy, Data, and Engineering, covering acceptable use, AI risk assessments, an approved tool and model inventory, and AI vendor oversight.
Secure enterprise and client-facing AI, including Microsoft 365 Copilot data governance and Amazon Bedrock and other AWS AI services, and address prompt injection, data leakage, model misuse, and shadow AI.
Represent BI WORLDWIDE in client security and compliance reviews, RFPs, contract negotiations, and leadership briefings, positioning security as a competitive differentiator.
Build a culture of security and compliance through engaging training, phishing simulations, and clear, approachable communication with employees at every level.