Principal Information Security Identity and Data Security

Innovate with purpose

At BILL we believe in empowering the businesses that drive our economy. By replacing outdated financial processes with innovative tools we help businessesfrom startups to established brandsmake smarter decisions and gain control of their operations. And we dont stop there: were creating the future of financial automation so businesses can spend more time on what matters.

Working here means you become part of a vision-driven team thats ready to tackle challenges and build cutting-edge solutions. We value purpose drive and curiosityand we thrive in a fast-paced ever-changing environment. Were remote-first with office spaces in San Jose CA and Draper UT and opportunities to connect in person when it counts. BILLders collaborate to deliver real impact for businesses that need more time in their busy weeks.

BILL builds high performing teams and we seek to hire the best talent for every role. Were committed to building a workplace that fosters inclusion and diverse perspectives valuing each persons unique skills and experiences. Wed love to hear from youyou might be just what were looking for whether in this role or another.

Lets give businesses more time for what matters.

Make your impact within a rapidly growing Fintech Company

As part of our Identity and Data Security team you will be accountable for the strategy security and governance of digital identitiesboth human (employees contractors business partners) and non-human (agents bots service accounts IoT). In addition this role will oversee and coordinate BILLs governance risk compliance (GRC) and remediation activities related to data security. This position will report directly to the Security GRC Leader. This role addresses all aspects of administration enforcement compliance education investigation and contingency planning related to identity and data security aligning with stakeholders in IT Privacy Legal Internal Audit and Engineering teams to ensure BILLs rigorous data control standards are met. This role is a hands-on IC security leader role with the expectation that work will vary between strategic and operational.

Responsibilities:

This job description intends to provide an overview of the general nature of the work and is not intended to reflect an exhaustive listing of responsibilities or requirements. The company reserves the right to update modify discontinue or change the requirements of any job as determined by business needs with or without prior notice.

• Serve as a bridge between technical teams (like IT and Security) and executive leadership turning complex risk landscapes into clear business insights.
• Implement measures and governance frameworks to manage data use in compliance with laws and regulations
• Monitor the regulatory and statutory landscape on identity and data security issues keeping BILL personnel and senior leadership apprised of any relevant developments impacting the companys business goals and objectives and recommending appropriate courses of action as needed
• Review projects business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
• Develop and advance the multi-year identity security strategy and roadmap prioritizing improvements based on risk business needs technology evolution and the maturity and effectiveness of existing IAM capabilities
• Oversee Identity Governance and Administration (IGA) processesmanaging new hires transfers and terminations to ensure least-privilege access across the entire enterprise.
• Manage Single Sign-On (SSO) Multi-Factor Authentication (MFA) and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.
• Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.
• Provide security strategy and guidance for customer-facing identity capabilities including authentication secure registration profile management federated/social login in partnership with Product and Engineering.
• Assess and evolve security requirements for non-human identifies including service accounts APIs AI agents with appropriate authentication authorization least privilege monitoring and accountability.
• Assess sensitive-data security risks and the effectiveness of related controls leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
• Advance data governance and protection by improving visibility into sensitive data across the ecosystem such as data inventory classification security controls retention and appropriate use across product environments corporate environments third parties and AI enabled use cases.

We would love to chat if you have:

• Bachelors degree in cyber security (or) related degree or equivalent work experience
• 10-15 years of experience in Information Security with significant experience in identity security and/or data security and demonstrated experience identifying systemic gaps and applying risk control and governance principles to mature security capabilities.
• Certified Information Security Systems Professional (CISSP) Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferred
• Experience assessing security risks and control effectiveness applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.
• Demonstrated ability to lead complex cross-functional initiatives and influence stakeholders without direct authority.
• Strong expertise in enterprise identity security lifecycle identity governance and modern access control models with experience across workforce privileged non-human and AI enabled identities.
• Strong expertise in data security and governance including data discovery and inventory classification access handling protection retention and secure disposal.
• Ability to align security and compliance objectives with the broader business goals and growth strategy developing and executing multi-year security strategies and roadmaps

• Proven track record of scaling GRC identity and/or data security programs.
• Deep knowledge of frameworks such as NIST ISO 27001 and various regional/industry-specific regulations.
• Effectively partner cross-functionally with Legal HR Finance Engineering and IT to embed risk management into day-to-day operations.
• Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.
• Experience with enterprise platforms like AWS Okta AD MS Azure Lumos etc.
• Hands on experience with Access Management workflows for all identity transactions (Moves Adds Transfers and Changes)

#LI

Whats in it for you

Redefining how businesses automate their work is a fast-paced exciting and fun environment. But we also have benefits and perks to ensure the magic isnt only experienced by our customers but by our employees as well.

Here is a preview of some of the amazing benefits here at BILL:

• 100% paid employee health dental and vision plans (choose HMO PPO or HDHP)
• HSA & FSA accounts
• Life Insurance Long & Short-term disability coverage
• Employee Assistance Program (EAP)
• 11 Observed holidays and wellness days and flexible time off
• Employee Stock Purchase Program with employee discounts
• Wellness & Fitness initiatives
• Employee recognition and referral programs
• And much more

Dont believe us Check out our culture benefits and teams on our career site LinkedIn Life or YouTube pages.

BILL is an Equal Opportunity Employer. We believe our best ideas come from the unique stories perspectives and experiences of our team members. We welcome people of all backgrounds abilities and identities to bring their authentic selves and contribute to our culture.

We are committed to a transparent inclusive hiring process that reflects our values. If you need accommodations at any stage please contact . To ensure a fair evaluation our Candidate Integrity Policy prohibits the use of unapproved external assistance including generative AI during live interviews or assessments. Doing so will result in a review and potential disqualification.

Our Applicant Privacy Notice describes how BILL treats the personal information it receives from applicants.