This job description intends to provide an overview of the general nature of the work and is not intended to reflect an exhaustive listing of responsibilities or requirements. The company reserves the right to update, modify, discontinue, or change the requirements of any job as determined by business needs with or without prior notice.
Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.
Implement measures and governance frameworks to manage data use in compliance with laws and regulations
Monitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as needed
Review projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practices
Develop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilities
Oversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.
Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.
Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.
Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.
Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability.
Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use.
