InfoSec Controls Mapping & Governance Lead

Koitecc Solutions; Denver, Northern (CO, KY); Hybrid; USD 78,000 - 136,000; Full time

Benefits offered by this job

Discretionary incentive plan

Benefits eligible

Job summary

Bank of America is seeking an information security professional to join the Controls Mapping Governance team. The role focuses on interpreting security requirements, mapping them to processes and controls, and determining the adequacy of evidence.

You will engage process owners and assess coverage against regulatory and policy expectations. The successful candidate will discuss technical concepts with SMEs, validate evidence, and drive defensible mapping decisions for governance audiences.

Qualifications

• Must have strong understanding of security policies and regulatory requirements.
• Ability to translate complex regulatory language into actionable controls.
• Experience communicating with senior stakeholders and technical teams.
• Familiarity with audit, governance, and compliance concepts.
• Analytical mindset to validate evidence and mappings.

Responsibilities

• Interpret laws, rules, regulations, policies, and standards; break complex requirements into must statements and define outcomes.
• Identify and assess candidate processes and controls; develop coverage recommendations.
• Review technical processes and challenge owner responses for evidence support.
• Document mapping decisions and determine coverage status or escalation.
• Use data and approved tools to support interpretation, coverage, reporting and process improvement.

Skills

Customer focus

Interpret laws

Rules and regulations

Policies

Procedures and guidelines

Problem solving

Quality assurance

Business acumen

Job description

Bank of America is seeking an information security professional to join the Controls Mapping Governance team. The role focuses on interpreting security requirements, mapping them to processes and controls, and determining the adequacy of evidence.

You will engage process owners and assess coverage against regulatory and policy expectations. The successful candidate will discuss technical concepts with SMEs, validate evidence, and drive defensible mapping decisions for governance audiences.