Principal Information Security - Identity and Data Security

BILL; United States; Remote; USD 243,000 - 304,000; Full time

Benefits offered by this job

Health insurance

Dental & vision

401(k) plan

Paid time off

Wellness programs

Job summary

BILL is seeking an experienced Identity and Data Security leader to own the strategy, security, and governance of digital identities across human and non-human entities. The role partners with IT, Privacy, Legal, Internal Audit, and Engineering to ensure BILL’s data control standards are met, in a hands-on IC capacity with strategic and operational duties.

This senior position drives IAM/IGA, SSO, MFA, and adaptive access, while shaping risk, governance, and data protection across BILL’s

Qualifications

• Overview of responsibility to govern identity and data security across human and non-human identities.
• Bachelor’s degree in cyber security (or related field) or equivalent work experience.
• Experience leading complex cross-functional security initiatives and influencing stakeholders.

Responsibilities

• Bridge between IT/Security and executive leadership to translate risk into business insights.
• Implement governance frameworks to manage data use in compliance with laws and regulations.
• Monitor regulatory landscape and advise on actions to tighten controls.
• Review projects and remediate control weaknesses for identity/data security and compliance.
• Develop multi-year identity security strategy and roadmap focusing on risk and maturity.
• Oversee Identity Governance and Administration (IGA) processes for least-privilege access.
• Manage SSO, MFA, and Adaptive Access policies across the enterprise.
• Secure high-risk privileges for admins and service accounts to prevent breaches.
• Provide security guidance for customer-facing identity capabilities with Product/Engineering.
• Assess sensitive-data security risks and strengthen data protection controls.
• Advance data governance across product environments and third parties.

Skills

Identity security

Data security

Governance

Risk management

Cross-functional leadership

Regulatory knowledge

Security strategy

Security programs

Education

Bachelor's degree in cyber security or related field

Tools

AWS

Okta

Azure

Lumos

Job description

Innovate with purpose

At BILL, we believe in empowering the businesses that drive our economy. By replacing outdated financial processes with innovative tools, we help businesses—from startups to established brands—make smarter decisions and gain control of their operations. And we don’t stop there: we’re creating the future of financial automation so businesses can spend more time on what matters.

Working here means you become part of a vision-driven team that’s ready to tackle challenges and build cutting-edge solutions. We value purpose, drive, and curiosity—and we thrive in a fast-paced, ever-changing environment. We’re remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts. BILLders collaborate to deliver real impact for businesses that need more time in their busy weeks.

BILL builds high performing teams and we seek to hire the best talent for every role. We’re committed to building a workplace that fosters inclusion and diverse perspectives, valuing each person’s unique skills and experiences. We’d love to hear from you—you might be just what we’re looking for, whether in this role or another.

Let’s give businesses more time for what matters.

Make your impact within a rapidly growing Fintech Company

As part of our Identity and Data Security team, you will be accountable for the strategy, security, and governance of digital identities—both human (employees, contractors, business partners) and non-human (agents, bots, service accounts, IoT). In addition, this role will oversee and coordinate BILL’s governance, risk, compliance (GRC), and remediation activities related to data security. This position will report directly to the Security GRC Leader. This role addresses all aspects of administration, enforcement, compliance, education, investigation, and contingency planning related to identity and data security, aligning with stakeholders in IT, Privacy Legal, Internal Audit, and Engineering teams to ensure BILL’s rigorous data control standards are met. This role is a hands‑on IC security leader role with the expectation that work will vary between strategic and operational.

Responsibilities:

This job description intends to provide an overview of the general nature of the work and is not intended to reflect an exhaustive listing of responsibilities or requirements. The company reserves the right to update, modify, discontinue, or change the requirements of any job as determined by business needs with or without prior notice.

• Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.
• Implement measures and governance frameworks to manage data use in compliance with laws and regulations
• Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed
• Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
• Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities
• Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.
• Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context‑aware security checks are applied.
• Secure high‑risk privileges for administrators and service accounts to prevent lateral movement during a breach.
• Provide security strategy and guidance for customer‑facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.
• Assess and evolve security requirements for non‑human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability.
• Assess sensitive‑data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
• Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases.

We would love to chat if you have:

• Bachelor’s degree in cyber security (or) related degree or equivalent work experience

• 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.

• Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred

• Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk‑reduction actions.

• Demonstrated ability to lead complex, cross‑functional initiatives and influence stakeholders without direct authority.

• Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non‑human, and AI enabled identities.

• Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.

• Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi‑year security strategies and roadmaps

• Proven track record of scaling GRC, identity, and/or data security programs.

• Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry‑specific regulations.

• Effectively partner cross‑functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day‑to‑day operations.

• Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.

• Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.

• Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)

The estimated salary range for this role is noted below for our San Jose based role. Our ranges for each role and job level are based on a variety of factors including candidate experience, expertise, and geographic location and may vary from the amounts listed above. The role is also eligible for a competitive benefits package that includes: medical, dental, vision, life and disability insurance, 401(k) retirement plan, flexible spending & health savings account, paid holidays, paid time off, and other company benefits.

San Jose pay range

$243,200—$304,000 USD

The On Target Earnings (OTE) range for this role is noted below for our office location in Draper, UT. This role is eligible to participate in BILL’s sales incentive and equity plans. Our ranges for each role and job level are based on a variety of factors including candidate experience, expertise, and geographic location and may vary from the amounts listed above. The role is also eligible for a competitive benefits package that includes: medical, dental, vision, life and disability insurance, 401(k) retirement plan, flexible spending & health savings account, paid holidays, paid time off, and other company benefits.

Draper UT pay range

$206,700—$258,400 USD

What’s in it for you?

Redefining how businesses automate their work is a fast‑paced, exciting, and fun environment. But we also have benefits and perks to ensure the magic isn’t only experienced by our customers, but by our employees as well.

Here is a preview of some of the amazing benefits here at BILL:

• 100% paid employee health, dental, and vision plans (choose HMO, PPO, or HDHP)
• HSA & FSA accounts
• Life Insurance, Long & Short‑term disability coverage
• Employee Assistance Program (EAP)
• 11+ Observed holidays and wellness days and flexible time off
• Employee Stock Purchase Program with employee discounts
• Wellness & Fitness initiatives
• Employee recognition and referral programs
• And much more

Don’t believe us? Check out our culture, benefits, and teams on our career site, LinkedIn Life, or YouTube pages.

BILL is an Equal Opportunity Employer. We believe our best ideas come from the unique stories, perspectives, and experiences of our team members. We welcome people of all backgrounds, abilities, and identities to bring their authentic selves and contribute to our culture.

We are committed to a transparent, inclusive hiring process that reflects our values. If you need accommodations at any stage, please contact [e-mail]. To ensure a fair evaluation, our Candidate Integrity Policy prohibits the use of unapproved external assistance, including generative AI, during live interviews or assessments. Doing so will result in a review and potential disqualification.

Our Applicant Privacy Notice describes how BILL treats the personal information it receives from applicants.