Vice President - Information Security & Compliance

BI Worldwide•Edina, MN

About The Position

BI WORLDWIDE seeks a strategic leader to direct enterprise information security, IT compliance, and AI governance. As the company's senior-most security and compliance leader, this person owns its security vision, cyber risk posture, regulatory and contractual compliance, and client assurance programs. The role advises senior leadership and the board, represents BI WORLDWIDE to clients and auditors, and mobilizes teams across the company. It requires current technical depth in Microsoft 365 and AWS and the ability to translate strategy into measurable risk reduction and sustained compliance. The Vice President owns information security and IT compliance across BI WORLDWIDE, covering strategy, governance, risk, assurance, and protection of corporate, infrastructure, and client-facing environments. The scope spans corporate IT, identity, endpoints, collaboration platforms, cloud infrastructure, client platforms, and AI use. The leader partners closely with Legal, Privacy, Internal Audit, Engineering, Infrastructure, Data, and business leaders, and is expected to remain technically fluent and engage directly in architecture and incident decisions. The role directs security for Microsoft 365, AWS, and the broader SaaS portfolio; advances Zero Trust; oversees security operations, incident response, secure development, and business continuity; and establishes and co-leads AI governance. It also represents the company in client security and compliance reviews, RFPs, contract negotiations, and leadership briefings, while building a culture of security and compliance.

Requirements

15+ years of progressive experience in information security, risk, and compliance, including 7+ years leading security teams and 3+ years as an organization's senior-most security leader or that person's deputy.
A proven record of building or maturing an enterprise security and compliance program with measurable gains in risk posture and program maturity.
A track record of achieving and sustaining SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 42001, or comparable attestations and certifications.
Experience presenting to executives, customers, and audit and risk committees and translating technical risk into business impact.
Experience managing a security and compliance budget, a multidisciplinary team, and strategic MSSP/MDR partners.
Current, hands-on depth securing Microsoft 365, including Entra ID, Conditional Access, Intune, Defender XDR, Purview, and Sentinel.
Current, hands-on depth securing AWS at scale, including multi-account architecture, IAM, network controls, encryption/KMS, CloudTrail, GuardDuty, Security Hub, and infrastructure-as-code guardrails.
Experience securing enterprise AI, including Microsoft 365 Copilot readiness, AWS AI services such as Amazon Bedrock, and AI threats described by the OWASP Top 10 for LLM Applications and MITRE ATLAS.
Strong command of identity and access management, Zero Trust, endpoint and network security, data protection, application security, and detection and response.
Experience leading incidents from detection through recovery, regulatory notification, and post-incident review.
Deep knowledge of NIST CSF, NIST SP 800-53, CIS Controls, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 1 and SOC 2.
Working knowledge of global privacy regulation, including GDPR, CCPA/CPRA, and U.S. state privacy laws, and experience partnering with Legal and Privacy on compliance.
Experience building an AI governance program, with knowledge of the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, and U.S. state AI laws.
Experience implementing a GRC platform and continuous control monitoring.
Experience leading external audits and client security assessments, including client questions about how the company uses AI with their data.
Credibility with executives, leadership, employees at every level, and customers.
Ability to distill complex security and regulatory topics into clear decisions for technical and non-technical audiences.
A business-enabling mindset that finds the secure, compliant path to yes.
Experience representing security and compliance directly to clients in sales cycles, contract negotiations, and leadership briefings.
Bachelor's degree in computer science, information security, or a related field, or equivalent experience.

Nice To Haves

A master's degree (MS, MBA).
Security and audit certifications such as CISSP, CISM, CRISC, CISA, CCSP, AWS Certified Security -- Specialty, or Microsoft Certified: Cybersecurity Architect Expert (SC-100).
Privacy and AI governance credentials such as CIPP/US, CIPM, or the IAPP Artificial Intelligence Governance Professional (AIGP).
Security and compliance leadership in a client-services, marketing, incentives, or SaaS company that handles client and consumer data.
Experience securing multi-tenant, client-facing platforms and payment-related workflows.
Service on an enterprise AI or risk steering committee.
Experience with DevSecOps, CI/CD pipeline security, and container and Kubernetes security.
Data and analytics platform security experience, such as Databricks.
Experience with cyber insurance, regulatory reporting, and crisis communications.

Responsibilities

Set and execute a multi-year information security and compliance strategy aligned with business objectives, client commitments, and enterprise risk appetite.
Serve as the accountable leader for information security and IT compliance, advising senior leadership and the board on cyber risk, regulatory exposure, and program investment.
Build and lead teams across security architecture and engineering, security operations, identity and access management, governance, risk and compliance, and awareness.
Own the security and compliance budget, technology portfolio, and strategic partners, including MSSP/MDR providers; rationalize tools and demonstrate return on investment.
Report program maturity, risk posture, and compliance status to senior leadership using metrics and KPIs.
Own the enterprise information security and IT compliance program, including the policy framework, control library, and compliance calendar.
Direct attestation and certification programs, audit readiness, evidence management, and remediation for standards including SOC 1, SOC 2 Type II, and ISO/IEC 27001, 27017, 27018, and 42001.
Lead cyber risk management by identifying, quantifying, and prioritizing risk, maintaining the risk register, and driving remediation to closure.
Partner with Legal and Privacy to meet global privacy and data protection obligations, including GDPR, CCPA/CPRA, and other U.S. state and international privacy laws.
Monitor emerging regulations and client requirements, assess their impact, and adapt controls ahead of new obligations.
Implement continuous control monitoring and a GRC platform that provides real-time visibility into compliance posture.
Govern third-party and vendor risk, from due diligence and contract terms through ongoing monitoring.
Serve as the primary point of accountability to Internal Audit, external auditors, and regulators for information security and IT compliance.
Direct security for the Microsoft 365 ecosystem, including Entra ID, Conditional Access, Intune, Defender XDR, Purview data protection and DLP, and Sentinel.
Direct AWS security, including multi-account governance, IAM and least privilege, network security, encryption and key management, logging and detection, and cloud security posture management.
Direct security for the broader SaaS portfolio, including Salesforce, Workday, and ServiceNow, encompassing SSPM, configuration baselines, third-party app and OAuth governance, shadow IT discovery, and secure SaaS-to-SaaS integrations.
Advance Zero Trust architecture across identity, endpoints, networks, data, applications, and cloud workloads.
Oversee security operations, threat detection, vulnerability management, and penetration testing.
Lead incident response and crisis management, including tabletop exercises, leadership and client communications, regulatory notifications, and coordination with Legal, insurers, and law enforcement.
Embed secure-by-design practices into the software development lifecycle and CI/CD pipelines in partnership with engineering and product leaders.
Align business continuity and disaster recovery programs with IT and business leaders.
Establish and co-lead the company's AI governance program with Legal, Privacy, Data, and Engineering, covering acceptable use, AI risk assessments, an approved tool and model inventory, and AI vendor oversight.
Secure enterprise and client-facing AI, including Microsoft 365 Copilot data governance, Amazon Bedrock and other AWS AI services, and defenses against prompt injection, data leakage, model misuse, and shadow AI.
Represent BI WORLDWIDE in client security and compliance reviews, RFPs, contract negotiations, and leadership briefings, positioning security as a competitive differentiator.
Build a culture of security and compliance through engaging training, phishing simulations, and clear, approachable communication with employees at every level.