Global Information Security Lead: GRC & Ops

BOAfit; Denver (CO); Hybrid; USD 105,000 - 125,000; Full time

Benefits offered by this job

Healthcare plans

HSA contributions

3 weeks PTO to start

Sick leave and family leave

401K retirement plan (matching)

Stock options eligible

Job summary

BOA is seeking an Information Security Lead to coordinate and advance its global cybersecurity program. You will focus on governance, risk, compliance, and day-to-day security operations while partnering with IT Operations and Business Systems Analysts to execute the security roadmap.

Responsibilities span policy maintenance, audits, access governance, vulnerability remediation, and security awareness. A strong background in NIST CSF 2.0, cloud and on-prem security, and cross-team coordination

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience.
• 5+ years of professional experience in information security, IT risk management, or IT operations with significant security responsibilities.
• Practical experience applying recognized security frameworks, such as NIST CSF 2.0, CIS Controls, or ISO/IEC 27001, to risk assessments, policies, controls, and program improvement.
• Working knowledge of Windows, macOS, and Linux environments, and Microsoft security and identity technologies, including Microsoft 365,Azure, Active Directory, Microsoft Entra ID, Intune, and Microsoft Defender.
• Hands-on proficiency in monitoring and triaging security alerts, investigating potential threats, and initiating appropriate incident response actions.
• Solid understanding of networking, identity and access management, and on-premises and cloud infrastructure security fundamentals.
• Strong communication, organizational, and analytical skills, with the ability to coordinate security initiatives across technical teams, departments, and 3rd parties.

Responsibilities

• Reflect and role model BOA’s vision, values and Leadership Model and demonstrate passion for our mission across the IT team and rest of the organization.
• Support the development and execution of BOA’s information security strategy and multi-year roadmap in partnership with the Director of Business Systems and IT.
• Assess security program maturity using NIST CSF 2.0; coordinate annual independent security assessments and audits; document, prioritize, and track findings through remediation closure.
• Develop and maintain enterprise security policies, standards, and procedures; manage the information security risk register, risk management plans, and documented exception process across global operations.
• Oversee identity and access governance, including periodic user access reviews, privileged access oversight, and segregation of duties (SoD), providing an independent control-review perspective.
• Serve as the primary information security contact for internal and external auditors; coordinate control evidence and support SOX ITGC testing and remediation.
• Manage third-party cyber risk through vendor assessments, review of vendor security reports and other assurance materials, and follow-up on identified gaps.
• Lead global security awareness initiatives, including phishing simulations and practical guidance on social engineering, data protection, and secure use of software systems and tools.
• Lead the vulnerability management process: evaluate exposure and business impact, establish remediation priorities and timelines, coordinate with IT Operations, and verify corrective actions.
• Oversee security monitoring coverage and investigate or triage security alerts, events, and tickets; collaborate with external security service providers and internal technical teams as needed.
• Maintain and exercise incident response procedures; coordinate investigations, escalation, containment, recovery, and lessons learned. Partner with IT Operations on disaster recovery exercises and resilience testing.
• Define and report meaningful security metrics, control effectiveness, program progress, and material risks to IT and company leadership; advise on security requirements for technology and business initiatives.
• Monitor relevant cyber threats, regulatory developments, and security practices; recommend pragmatic improvements suited to BOA’s risk profile.

Skills

Communication skills

Organizational skills

Analytical skills

Incident response

Education

Bachelor’s degree in Information Security or related field

Tools

Microsoft 365

Azure

Active Directory

Microsoft Entra ID

Intune

Microsoft Defender

Job description

BOA is seeking an Information Security Lead to coordinate and advance its global cybersecurity program. You will focus on governance, risk, compliance, and day-to-day security operations while partnering with IT Operations and Business Systems Analysts to execute the security roadmap.

Responsibilities span policy maintenance, audits, access governance, vulnerability remediation, and security awareness. A strong background in NIST CSF 2.0, cloud and on-prem security, and cross-team coordination