Principal Information Security - Identity and Data Security
BILL · Draper, UT · 3 wk ago
Education$243k–$304k/yrFull-time
We need to output HTML fragment with sections: About the role? Actually the posting includes intro paragraphs about company, then "Make Your Impact Within a Rapidly Growing Fintech Company" then description of role responsibilities, then "We Would Love To Chat If You Have ..." which is qualifications/requirements, then salary ranges, benefits, etc. We need to use for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real specific content. We need to decide which sections to include.
We have content: "Make Your Impact Within a Rapidly Growing Fintech Company" could be About the role? Actually that is a heading in the posting. Could map to "About the role". Then "Responsibilities" heading present. Then "We Would Love To Chat If You Have ..." includes qualifications, experience, certifications, etc. That could be Requirements or Qualifications or Skills. We need to decide.
We have salary ranges: San Jose pay range and Draper UT pay range. So we can include Pay section with both ranges.
Benefits: there is a "What’s in it for you?" section listing benefits. Also earlier mention of competitive benefits package. So Benefits section.
Schedule: not mentioned (remote-first, office spaces). Could be considered Schedule? Not explicit. Probably skip Schedule.
We also have "We're remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts." That could be part of About the role or maybe Work location. Not a required heading.
We must not repeat job title as heading. No Job ID.
We must remove boilerplate: EEO, equal opportunity, scam warning, privacy notice, candidate integrity policy, etc. Also remove "This job description intends to provide an overview..." etc. Also remove "The company reserves the right..." etc. Also remove "We Would Love To Chat If You Have" maybe keep as Requirements.
We need to preserve all substantive information: responsibilities list, qualifications list, benefits list, salary ranges, remote-first info, etc.
We must use
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real specific content. We need to decide which sections to include.
We have content: "Make Your Impact Within a Rapidly Growing Fintech Company" could be About the role? Actually that is a heading in the posting. Could map to "About the role". Then "Responsibilities" heading present. Then "We Would Love To Chat If You Have ..." includes qualifications, experience, certifications, etc. That could be Requirements or Qualifications or Skills. We need to decide.
We have salary ranges: San Jose pay range and Draper UT pay range. So we can include Pay section with both ranges.
Benefits: there is a "What’s in it for you?" section listing benefits. Also earlier mention of competitive benefits package. So Benefits section.
Schedule: not mentioned (remote-first, office spaces). Could be considered Schedule? Not explicit. Probably skip Schedule.
We also have "We're remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts." That could be part of About the role or maybe Work location. Not a required heading.
We must not repeat job title as heading. No Job ID.
We must remove boilerplate: EEO, equal opportunity, scam warning, privacy notice, candidate integrity policy, etc. Also remove "This job description intends to provide an overview..." etc. Also remove "The company reserves the right..." etc. Also remove "We Would Love To Chat If You Have" maybe keep as Requirements.
We need to preserve all substantive information: responsibilities list, qualifications list, benefits list, salary ranges, remote-first info, etc.
We must use - for any list of duties/requirements/benefits. Use
for prose.
We must not create sections with filler like "commensurate with experience". Not present.
We need to output only HTML fragment.
Let's structure:
About the role
Intro paragraphs about BILL mission, remote-first, office locations, etc.
Responsibilities
- ...
... list each responsibility bullet.
We need to extract responsibilities from the block after "Responsibilities". The bullet points start after "Serve as a bridge..." etc. Let's list them:
- Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.
- Implement measures and governance frameworks to manage data use in compliance with laws and regulations
- Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed
- Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
- Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities
- Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.
- Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.
- Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.
- Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.
- Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability.
- Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
- Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases.
That's a lot. We'll put each as - .
Next section: Requirements/Qualifications/Skills. The posting has "We Would Love To Chat If You Have" then list of qualifications. Let's capture:
- Bachelor’s degree in cyber security (or) related degree or equivalent work experience
- 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
- Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
- Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
- Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
- Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
- Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
- Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps
- Proven track record of scaling GRC, identity, and/or data security programs.
- Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
- Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
- Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
- Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
- Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)
We could split into Requirements (experience, education) and Skills (technical expertise). But we have headings: Requirements, Qualifications, Skills. We need to decide which to use. The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can include multiple of those if content exists.
We have content for Requirements (education, years experience). We have content for Qualifications (certifications). We have content for Skills (expertise, abilities). Could combine but better to separate.
Let's create:
Requirements
- Bachelor’s degree in cyber security (or) related degree or equivalent work experience
- 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
Qualifications
- Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
Skills
- Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
- Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
- Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
- Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
- Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps
- Proven track record of scaling GRC, identity, and/or data security programs.
- Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
- Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
- Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
- Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
- Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)
Next Benefits: we have "What’s in it for you?" list plus earlier mention of competitive benefits package. We'll include Benefits section with list.
Benefits list:
- 100% paid employee health, dental, and vision plans (choose HMO, PPO, or HDHP)
- HSA & FSA accounts
- Life Insurance, Long & Short-term disability coverage
- Employee Assistance Program (EAP)
- 11+ Observed holidays and wellness days and flexible time off
- Employee Stock Purchase Program with employee discounts
- Wellness & Fitness initiatives
- Employee recognition and referral programs
- And much more (maybe we can keep as is but it's vague; but it's part of list). We'll include as item.
Also earlier: medical, dental, vision, life and disability insurance, 401(k) retirement plan, flexible spending & health savings account, paid holidays, paid time off, and other company benefits. That overlaps; we can combine but better to keep the detailed list.
We'll output Benefits with those items.
Pay: we have San Jose pay range $243,200—$304,000 USD and Draper UT pay range $206,700—$258,400 USD. Also mention OTE? Actually they mention On Target Earnings (OTE) range for Draper UT. It says "The On Target Earnings (OTE) range for this role is noted below for our office location in Draper, UT." Then they give Draper UT pay range. So we can present both.
We'll create Pay section with two paragraphs or list.
Schedule: not present; skip.
Also include About the role paragraph: we need to capture the intro about BILL mission, remote-first, office spaces, etc. Let's extract:
"Innovate with purpose At BILL, we believe in empowering the businesses that drive our economy. By replacing outdated financial processes with innovative tools, we help businesses—from startups to established brands—make smarter decisions and gain control of their operations. And we don’t stop there: we’re creating the future of financial automation so businesses can spend more time on what matters. Working here means you become part of a vision-driven team that’s ready to tackle challenges and build cutting-edge solutions. We value purpose, drive, and curiosity—and we thrive in a fast-paced, ever-changing environment. We're remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts. BILLders collaborate to deliver real impact for businesses that need more time in their busy weeks. BILL builds high performing teams and we seek to hire the best talent for every role. We're committed to building a workplace
for prose. We must not create sections with filler like "commensurate with experience". Not present. We need to output only HTML fragment. Let's structure:
About the role
Intro paragraphs about BILL mission, remote-first, office locations, etc.
Responsibilities
- ... ... list each responsibility bullet. We need to extract responsibilities from the block after "Responsibilities". The bullet points start after "Serve as a bridge..." etc. Let's list them: - Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights. - Implement measures and governance frameworks to manage data use in compliance with laws and regulations - Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed - Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices - Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities - Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise. - Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied. - Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach. - Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering. - Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability. - Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use. - Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases. That's a lot. We'll put each as
- .
Next section: Requirements/Qualifications/Skills. The posting has "We Would Love To Chat If You Have" then list of qualifications. Let's capture:
- Bachelor’s degree in cyber security (or) related degree or equivalent work experience
- 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
- Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
- Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
- Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
- Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
- Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
- Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps
- Proven track record of scaling GRC, identity, and/or data security programs.
- Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
- Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
- Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
- Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
- Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)
We could split into Requirements (experience, education) and Skills (technical expertise). But we have headings: Requirements, Qualifications, Skills. We need to decide which to use. The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can include multiple of those if content exists.
We have content for Requirements (education, years experience). We have content for Qualifications (certifications). We have content for Skills (expertise, abilities). Could combine but better to separate.
Let's create:
Requirements
- Bachelor’s degree in cyber security (or) related degree or equivalent work experience
- 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
Qualifications
- Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
Skills
- Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
- Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
- Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
- Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
- Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps
- Proven track record of scaling GRC, identity, and/or data security programs.
- Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
- Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
- Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
- Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
- Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)
- with those items.
Pay: we have San Jose pay range $243,200—$304,000 USD and Draper UT pay range $206,700—$258,400 USD. Also mention OTE? Actually they mention On Target Earnings (OTE) range for Draper UT. It says "The On Target Earnings (OTE) range for this role is noted below for our office location in Draper, UT." Then they give Draper UT pay range. So we can present both.
We'll create Pay section with two paragraphs or list.
Schedule: not present; skip.
Also include About the role paragraph: we need to capture the intro about BILL mission, remote-first, office spaces, etc. Let's extract:
"Innovate with purpose At BILL, we believe in empowering the businesses that drive our economy. By replacing outdated financial processes with innovative tools, we help businesses—from startups to established brands—make smarter decisions and gain control of their operations. And we don’t stop there: we’re creating the future of financial automation so businesses can spend more time on what matters. Working here means you become part of a vision-driven team that’s ready to tackle challenges and build cutting-edge solutions. We value purpose, drive, and curiosity—and we thrive in a fast-paced, ever-changing environment. We're remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts. BILLders collaborate to deliver real impact for businesses that need more time in their busy weeks. BILL builds high performing teams and we seek to hire the best talent for every role. We're committed to building a workplace