Security Controls Mapping Lead

Bank of America; Town of Vermont (WI); On-site; USD 85,000 - 115,000; Full time

Job summary

Bank of America is seeking an information security governance professional to interpret requirements, define must statements, and map controls with evidence. The role involves engaging process owners, evaluating coverage, and ensuring alignment with regulatory expectations.

The successful candidate will review technical procedures, challenge responses, and document defensible mapping decisions for technical and senior audiences. Strong communication and analytical skills are essential.

Qualifications

• 3+ years of experience in information security, cybersecurity risk, technology risk, controls governance, policy governance, compliance, audit, or a related field within a regulated environment.
• Knowledge of cybersecurity concepts and security domains such as identity and access management, network security, cloud security, application security, data protection, vulnerability management, monitoring, incident response, or configuration management.
• Ability to understand how security processes and controls operate across systems, applications, infrastructure, data, users, and technologies, without needing to be an engineer in every domain.
• Experience reviewing technical procedures, process flows, control descriptions, system documentation, and evidence artifacts to identify gaps or exclusions.
• Strong analytical and communication skills, including questioning subject matter experts and documenting defensible mapping decisions for technical audiences.
• Ability to validate data against requirements and supporting evidence rather than relying solely on owner conclusions.

Responsibilities

• Interpret laws, rules, regulations, policies, and standards; break complex requirements into must statements; define outcome, scope, ownership, and evidence.
• Identify and assess candidate processes and controls; develop coverage recommendations; determine coverage type (direct, supporting, partial, or insufficient).
• Review technical processes and challenge owner responses to ensure activity, scope, ownership, dependencies, limitations, and evidence support the mapping.
• Document clear mapping decisions and determine whether coverage should be accepted, clarified, treated as partial or a gap, or escalated through governance channels.
• Use data and approved tools to support interpretation, coverage identification, review, reporting, and process improvement, while validating outputs and maintaining accountability.

Skills

Information security

Cybersecurity risk

Policy governance

Audit

Regulatory compliance

Communication skills

Analytical skills

Job description

Bank of America is seeking an information security governance professional to interpret requirements, define must statements, and map controls with evidence. The role involves engaging process owners, evaluating coverage, and ensuring alignment with regulatory expectations.

The successful candidate will review technical procedures, challenge responses, and document defensible mapping decisions for technical and senior audiences. Strong communication and analytical skills are essential.