InfoSec Controls Mapping Lead

Bank of America; Washington (District of Columbia); On-site; USD 78,000 - 136,000; Full time

Job summary

Bank of America is seeking an information security professional for the Controls Mapping Governance team to interpret requirements, map controls, and validate evidence across the enterprise. The role engages with process owners and SMEs to ensure coverage aligns with regulatory and policy intent.

The candidate will assess coverage, document defensible mapping decisions, and use approved tools to support reporting and process improvement in a collaborative, in-office environment.

Qualifications

• 3+ years of information security, cybersecurity risk, policy governance, compliance, audit, or related field in a regulated environment.
• Knowledge of security concepts across IAM, network, cloud, application security, data protection, vulnerability management, monitoring, incident response, or configuration management.
• Ability to understand security processes and controls across systems without needing to be an engineer in every domain.
• Experience reviewing procedures, process flows, control descriptions, system documentation, and evidence artifacts to identify gaps.

Responsibilities

• Interpret laws, rules, regulations, policies, and standards; define outcomes, scope, owners, and evidence.
• Identify and assess candidate processes and controls; determine coverage type (direct, supporting, partial, or insufficient).
• Review technical processes and challenge owner responses to ensure evidence supports mapping.
• Document mapping decisions and escalate gaps through governance channels as needed.
• Use data and approved tools to support interpretation, coverage identification, review, reporting, and process improvement with validated outputs.

Skills

Information security

Cybersecurity risk

Policy governance

Regulatory compliance

Technical communication

Tools

SharePoint

Job description

Bank of America is seeking an information security professional for the Controls Mapping Governance team to interpret requirements, map controls, and validate evidence across the enterprise. The role engages with process owners and SMEs to ensure coverage aligns with regulatory and policy intent.

The candidate will assess coverage, document defensible mapping decisions, and use approved tools to support reporting and process improvement in a collaborative, in-office environment.