InfoSec Controls Mapping & Governance Lead

Hobbsnews; Addison, Northern (TX, KY); Hybrid; USD 78,000 - 136,000; Full time

Job summary

Bank of America is seeking an information security professional to interpret requirements, map controls, and validate evidence across systems and processes. The role involves engaging control owners, developing coverage recommendations, and ensuring defensible mapping for auditors and executives.

The candidate should discuss technical concepts with SMEs, assess coverage depth, and contribute to governance processes within an enterprise security program.

Qualifications

• 3+ years of experience in information security, cybersecurity risk, technology risk, controls governance, policy governance, compliance, audit, or a related field within a regulated environment.

Responsibilities

• Interpret laws, rules, regulations, policies, and standards; break complex requirements into individual must statements; define the required outcome, scope, accountable parties, and expected evidence.
• Identify and assess candidate processes, controls; develop preliminary coverage recommendations; determine whether coverage is direct, supporting, partial, or insufficient.
• Review technical processes and challenge owner responses to determine whether the documented activity, scope, ownership, dependencies, limitations, and evidence support the proposed mapping.
• Document clear, defensible mapping decisions and determine whether proposed coverage should be accepted, clarified, treated as partial or a gap, or escalated through established governance channels.
• Use data and approved tools to support requirement interpretation, coverage identification, response review, reporting, and process improvement, while independently validating outputs and maintaining decision accountability.

Job description

Bank of America is seeking an information security professional to interpret requirements, map controls, and validate evidence across systems and processes. The role involves engaging control owners, developing coverage recommendations, and ensuring defensible mapping for auditors and executives.

The candidate should discuss technical concepts with SMEs, assess coverage depth, and contribute to governance processes within an enterprise security program.