Security Controls Mapping & Governance Lead

Bank of America; Washington (District of Columbia); On-site; USD 110,000 - 135,000; Full time

Job summary

Bank of America is seeking an information security professional to interpret governance requirements, map controls across enterprise processes, and validate evidence to meet regulatory expectations. The role involves evaluating must statements, engaging control owners, and ensuring coverage is complete and defensible.

The candidate will demonstrate strong analytical and communication skills, ability to challenge SMEs, and experience in cybersecurity risk, policy governance, or related fields in

Qualifications

• 3+ years of information security, cybersecurity risk, policy governance, or related field in regulated environments.
• Knowledge of cybersecurity concepts and at least one domain (IAM, network, cloud, data protection, etc.).
• Ability to interpret complex requirements and map to processes and evidence.
• Experience reviewing procedures and control descriptions to identify gaps, exclusions, or incomplete responses.
• Strong analytical and communication skills to discuss with subject matter experts and document mapping decisions for leadership.

Responsibilities

• Interpret laws, rules, regulations, policies, procedures, and guidelines; break complex requirements into must statements and define outcome, scope, and evidence.
• Identify and assess candidate processes and controls; develop coverage recommendations and determine coverage status.
• Review technical processes and challenge owner responses to ensure activity, ownership, scope, dependencies, and evidence support mappings.
• Document clear, defensible mapping decisions and determine acceptance, gaps, or escalation through governance channels.
• Use data and approved tools to support interpretation, coverage identification, response review, reporting, and process improvement, while validating all outputs and maintaining accountability.

Skills

Customer and Client Focus

Interpret Relevant Laws

Rules and Regulations

Policies

Procedures and Guidelines

Problem Solving

Quality Assurance

Business Acumen

Job description

Bank of America is seeking an information security professional to interpret governance requirements, map controls across enterprise processes, and validate evidence to meet regulatory expectations. The role involves evaluating must statements, engaging control owners, and ensuring coverage is complete and defensible.

The candidate will demonstrate strong analytical and communication skills, ability to challenge SMEs, and experience in cybersecurity risk, policy governance, or related fields in