Principal Information Security - Identity and Data Security

Title: Principal Information Security - Identity and Data Security Location: Draper, Utah, United States; San Jose, California, United States

Make your impact within a rapidly growing Fintech Company

As part of our Identity and Data Security team, you will be accountable for the strategy, security, and governance of digital identities—both human (employees, contractors, business partners) and non-human (agents, bots, service accounts, IoT).  In addition, this role will oversee and coordinate BILL’s governance, risk, compliance (GRC), and remediation activities related to data security. This position will report directly to the Security GRC Leader. This role addresses all aspects of administration, enforcement, compliance, education, investigation, and contingency planning related to identity and data security, aligning with stakeholders in IT, Privacy Legal, Internal Audit, and Engineering teams to ensure BILL’s rigorous data control standards are met. This role is a hands-on IC security leader role with the expectation that work will vary between strategic and operational.

Responsibilities:

This job description intends to provide an overview of the general nature of the work and is not intended to reflect an exhaustive listing of responsibilities or requirements. The company reserves the right to update, modify, discontinue, or change the requirements of any job as determined by business needs with or without prior notice.

• Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.
• Implement measures and governance frameworks to manage data use in compliance with laws and regulations
• Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed
• Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
• Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities
• Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.
• Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.
• Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.
• Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.
• Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability.
• Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
• Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases.

We would love to chat if you have:

• Bachelor’s degree in cyber security (or) related degree or equivalent work experience
• 10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.
• Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
• Experience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
• Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.
• Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities.
• Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal.
• Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmaps

• Proven track record of scaling GRC, identity, and/or data security programs.
• Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.
• Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.
• Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
• Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.
• Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)

#LI