BISO - Enabling Units IT Security

About this role

The BISO Enabling Units IT Security serves as the Information Security Officer for the Enabling Units IT organization. This position reports to the AstraZeneca Global Head of Cybersecurity Business Operations. The BISO delivers risk management and security expertise to educate, enable, and empower Enabling Units IT and business stakeholders to safeguard information, platforms, and business-critical systems.

The BISO team ensures information security is understood and embedded across enterprise business functions. The team leads security consultants and risk analysts responsible for embedding the security policy framework, industry-standard controls, and secure-by-design initiatives into enterprise SaaS platforms, cloud services, and applications supporting Finance, HR, Global Corporate Affairs, Global Business Services, Legal, and M&A functions.

The BISO, is the primary strategic cybersecurity partner to Enabling Units IT, covering enterprise business functions including Finance, HR, Global Corporate Affairs, Global Business Services, Legal, and Mergers & Acquisitions. This customer-facing role represents the CISO by leading cybersecurity engagement, alignment, and delivery of cybersecurity risk and resilience outcomes across enterprise business applications and services.

The role provides strategic guidance on cybersecurity risks, priorities, and long-term security posture across enterprise SaaS platforms, cloud services, and applications such as Workday, SAP, Coupa, and Concur. A central focus is balancing business enablement with compliance, data protection, identity governance, vendor assurance, and resilience needs across enterprise functions. This leader directs cybersecurity consulting, risk management, remediation, posture reporting, and data analysis activities tailored to the enterprise SaaS and cloud platforms that underpin financial integrity, employee data protection, legal obligations, M&A activity, and critical business operations.

Accountabilities • Act as the primary strategic partner and security consultant to Enabling Units IT leadership, participating in governance forums that drive risk-based decisions, clear accountability, and visible security outcomes.

• Lead risk posture and architecture engagement for enterprise SaaS and cloud environments, supporting cybersecurity architects in defining cloud-native security patterns that fit business application needs.

• Lead security consulting and risk management for enterprise applications such as Workday, SAP, Coupa, and Concur, including identity and access management, data protection, integration security, privileged access governance, and vendor assurance.

• Ensure security controls support financial controls, SOX compliance, data privacy obligations including GDPR, M&A due diligence requirements, and electronic records/signatures expectations where applicable.

• Deliver change-controlled security improvements within enterprise applications and cloud services, including documentation expectations, governance alignment, and compensating controls where needed.

• Drive comprehensive application visibility, security posture reporting, and risk-based vulnerability or exposure management across enterprise SaaS and cloud platforms with continuous update models.

• Provide security consulting for critical enterprise integrations, including HR-to-Finance, procurement-to-payment, and other cross-functional data flows, ensuring secure patterns, identity controls, logging, and resilience.

• Strengthen third-party risk management for SaaS providers, cloud platforms, business service providers, and professional services partners, including contractual controls, ongoing assurance, and secure support models.

• Partner with security operations and business teams to create environment-specific incident response playbooks, tabletop exercises, and recovery readiness for business-critical enterprise applications.

• Maintain audit-ready security evidence for financial controls, SOX compliance, data privacy audits, Legal and M&A due diligence, and other enterprise assurance needs.

• Build enterprise-focused risk dashboards and KPIs covering SaaS security posture, identity governance maturity, critical exposure reduction, privileged access governance, vendor assurance, and recovery readiness.

• Tailor cybersecurity culture and training for Finance, HR, Legal, Global Corporate Affairs, Global Business Services, M&A, and related business users, emphasizing role-appropriate security practices.

• Coach a high-performing team with clear goals tied to measurable risk reduction, resilience improvement, and business enablement across Enabling Units IT.

Essential Skills & Experience Required • 10+ years of experience in information security positions, including 5+ years overseeing an information security function and influencing senior business and IT stakeholders.

• Demonstrated experience securing enterprise business applications, SaaS platforms, and cloud services, with the ability to translate business realities into effective cybersecurity controls.

• Strong familiarity with financial controls and SOX compliance, data privacy regulations including GDPR, electronic records/signatures regulations, and M&A due diligence requirements.

• Proven ability to design and operationalize cloud-native security patterns for enterprise SaaS platforms and business applications.

• Hands-on experience securing enterprise SaaS and cloud platforms, including identity and access management, data protection, integration security, privileged access governance, and vendor risk management.

• Working knowledge of enterprise security frameworks such as NIST CSF, ISO 27001/27002, and CIS Controls, with the ability to apply appropriate controls across business application environments.

• Experience running risk-based exposure management across enterprise SaaS and cloud platforms that operate under continuous update models.

• Understanding of global inci

Similar jobs

• Principal Business Information Security Officer (BISO) — LPL Financial · Fort Mill/Charlotte | San Diego
• IT Security Administrator — Uline · Pleasant Prairie, WI | Milwaukee, WI | Waukegan, IL
• IT Security Administrator — Bitwarden · Remote
• IT Security Administrator — Youthvillages · Corporate Headquarters, TN
• IT Security Manager — Albany Med · NY
• Information Systems Security Manager — Andurilindustries · Quincy, Massachusetts, United States
• Information Systems Security Manager — Andurilindustries · Costa Mesa, California, United States
• Information System Security Manager — Spacex · Hawthorne, CA