BISO-Business Information Security Officer

Elsevier • Full-time • Hybrid in Philadelphia, Pennsylvania, United States • $153,600 - $285,200 / year • 1m ago

Fast Facts

We are seeking a Business Information Security Officer (BISO) specializing in Cloud Computing to create and execute strategies for cybersecurity and risk management initiatives across our organization.

Responsibilities: You will lead enterprise-wide information security initiatives, manage risk assessments, and ensure compliance within cloud operations, while fostering security awareness and best practices across teams.

Skills: Expertise in AWS services, security architecture, compliance automation, and experience with CI/CD pipelines and security controls integration.

Qualifications: Strong proficiency with cloud security tools, hands-on experience with security controls integration, and ability to communicate technical risks to non-technical stakeholders are preferred qualifications.

Location: Philadelphia, PA (Penn Ctr)

Compensation: $153600 - $285200 / Annually

BISO for Cloud Computing

Do you want to create strategies and chart a course for our Cyber progress?

Are you interested in evangelizing our core information security tools and risk management solutions?

About our Team, This team delivers outcomes, longer-term improvements and benefits that are measurable and impact the achievement of organization goals. This includes managing complex and critical issues, creating strategies and charting a course for cyber progress.

About the Role as a BISO (reporting to our CISO) for Technology Infrastructure and Operations you will be responsible for planning, organizing, and executing enterprise-wide information and security initiatives. You will deliver long-term improvements and benefits impacting our organizational goals focusing on Cloud Infrastructure, risk management and cybersecurity defenses.

Requirements

Possess a strong proficiency with AWS services (EC2, S3, IAM, Lambda, CloudTrail, CloudWatch, KMS, GuardDuty, Security Hub, WAF, etc.).
Have the ability to design secure, scalable cloud architectures with proper identity, access management, and network segmentation.
Experience with AWS Config, AWS Control Tower, or Terraform for compliance automation and infrastructure as code (IaC).
Possess an understanding of Kubernetes (EKS), Docker, and container image scanning tools.
Hands-on experience integrating security controls into Jenkins, GitHub Actions, or GitLab CI pipelines.
Familiarity with code scanning tools (Snyk, SonarQube, Checkmarx, or Veracode) and dependency management.
Scripting proficiency (Python, Bash, or PowerShell) to automate security testing and compliance checks.
Experience implementing vault solutions (HashiCorp Vault, AWS Secrets Manager).
Ability to translate technical risks into business terms for senior stakeholders and non-technical leaders.
Experience partnering with IT, Cloud, and Business Units to embed security in strategic initiatives.
Leading security programs, tracking KPIs/metrics, and ensuring timely delivery of remediation plans. Designing and delivering cybersecurity awareness programs tailored to business functions.

Responsibilities

Driving information, cyber, and infrastructure security governance across all business and technology units, ensuring alignment with enterprise cybersecurity programs, objectives, and regulatory requirements.
Serving as the primary liaison between Business Units, Cloud Engineering, and the Cyber Security organization to embed security awareness and best practices into AWS cloud operations, CI/CD pipelines, and DevOps workflows.
Leading cloud security oversight for AWS environments, including configuration management, identity and access controls, encryption, and compliance with organizational policies and industry standards (ISO 27001, NIST, SOC 2).
Managing and coordinating technical risk assessments — including vulnerability scanning, penetration testing, and application risk reviews — to ensure secure deployment across cloud and hybrid infrastructures.
Overseeing the security posture of CI/CD pipelines (Jenkins, GitHub Actions, or similar), integrating automated scanning tools and secure code validation into build and deployment processes.
Collaborating with DevOps and Infrastructure teams to define and implement secure-by-design practices for containerized workloads, Kubernetes clusters, and AWS-native services (EKS, EC2, S3, Lambda).
Defining and executing a risk-based information and infrastructure security strategy, including setting measurable goals, developing security training programs, and creating roadmaps for improving DevSecOps maturity.
Developing and report cybersecurity metric scorecards to track compliance with enterprise standards, vulnerability remediation progress, and adoption of security controls across business and cloud environments.
Providing expert guidance on security architecture decisions, evaluating new tools and technologies for impact on cloud environments, automation frameworks, and enterprise security strategy.
Leading cross-functional security initiatives to ensure business innovation aligns with secure architecture principles, risk management standards, and ongoing governance frameworks.

Elsevier is a renowned global information analytics company that primarily focuses on providing scientific, technical, and medical (STM) research content, tools, and services. It is one of the largest publishers of academic journals and scholarly literature in the world. Elsevier operates in various domains, including science, technology, medicine, social sciences, and more. They publish a vast number of peer-reviewed journals covering a wide range of disciplines. These journals act as platforms for researchers and academics to share their findings and contribute to the advancement of knowledge in their respective fields

U.S. National Base Pay Range: $153,600 - $285,200. Geographic differentials may apply in some locations to better reflect local market rates. This job is eligible for an annual incentive bonus. We know that your wellbeing and happiness are key to a long and successful career. These are some of the benefits we are delighted to offer to our US full- and part-time employees working at least 20 hours or more per week: ● Health Benefits: Comprehensive, multi-carrier program for medical, dental and vision benefits ● Retirement Benefits: 401(k) with match and an Employee Share Purchase Plan ● Wellbeing: Wellness platform with incentives, Headspace app subscription, Employee Assistance and Time-off Programs ● Short-and-Long Term Disability, Life and Accidental Death Insurance, Critical Illness, and Hospital Indemnity ● Family Benefits, including bonding and family care leaves, adoption and surrogacy benefits ● Health Savings, Health Care, Dependent Care and Commuter Spending Accounts ● In addition to annual Paid Time Off, we offer up to two days of paid leave each to participate in Employee Resource Groups and to volunteer with your charity of choice

We are committed to providing a fair and accessible hiring process. If you have a disability or other need that requires accommodation or adjustment, please let us know by completing our Applicant Request Support Form or please contact 1-855-833-5120.

Criminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scams here.

Please read our Candidate Privacy Policy.

We are an equal opportunity employer: qualified applicants are considered for and treated during employment without regard to race, color, creed, religion, sex, national origin, citizenship status, disability status, protected veteran status, age, marital status, sexual orientation, gender identity, genetic information, or any other characteristic protected by law.

USA Job Seekers:

EEO Know Your Rights.