Senior Controls Mapping & Governance Lead

Bank of America; Denver (CO); On-site; USD 90,000 - 130,000; Full time

Job summary

Bank of America is seeking an information security professional to support governance, mapping requirements into controls, and evaluating evidence. You will interpret laws and determine whether coverage meets the intent and scope, engaging process and control owners to gather validation.

The successful candidate will discuss technical concepts with SMEs, document defensible mapping decisions, and report findings to senior audiences. Strong collaboration is essential.

Qualifications

• 3+ years in information security, cybersecurity risk, controls governance, or related regulated compliance.
• Knowledge of cybersecurity concepts and security domains (IAM, network, cloud, app, data protection).
• Ability to understand processes across systems without being an expert in every domain.
• Experience reviewing procedures and evidence to identify gaps.
• Strong analytical and communication skills. Ability to discuss technical concepts with SMEs.
• Ability to evaluate and validate data against requirements and evidence.

Responsibilities

• Interpret laws, rules, regulations, policies, and standards; break complex requirements into must statements; define outcomes, scope, ownership, and evidence.
• Identify and assess candidate processes, controls; develop coverage recommendations; determine coverage type (direct, supporting, partial, gap).
• Review technical processes and challenge owner responses to ensure activity scope, ownership, dependencies, and evidence support mapping.
• Document defensible mapping decisions and escalate through governance channels when needed.
• Use data and approved tools to support interpretation, coverage, reporting, and process improvement.

Skills

Customer Focus

Interpret Laws

Rules and Regulations

Policies

Procedures

Quality Assurance

Problem Solving

Business Acumen

Job description

Bank of America is seeking an information security professional to support governance, mapping requirements into controls, and evaluating evidence. You will interpret laws and determine whether coverage meets the intent and scope, engaging process and control owners to gather validation.

The successful candidate will discuss technical concepts with SMEs, document defensible mapping decisions, and report findings to senior audiences. Strong collaboration is essential.