Director, Brand Information Security Officer

Director, Brand Information Security Officer (BISO) serves as the senior cybersecurity leader and trusted advisor for the assigned brand or business unit, acting as the primary liaison between Global Cybersecurity Services (GCS), technology leadership, and business stakeholders. The BISO acts on behalf of the brand to align its cybersecurity strategy, risk management, compliance activities, and operational security initiatives with corporate security objectives while ensuring the successful delivery of security services, capabilities, and outcomes. The BISO drives security maturity, facilitates risk-informed decision making, acts as a collaborative consultant on identified issues, and takes ownership for delivering measurable security and business results across four role tenants: Security Governance & Compliance; Incident Remediation & Vulnerability Management; GCS Service Delivery & Requirements Management; and Business Advisory, Security Consulting & Solution Ownership.

Essential Functions:

• Security Governance, Risk & Compliance: Lead and oversee the brand’s cybersecurity strategy and governance program in alignment with Corporate and GCS security objectives. Ensure compliance with corporate security policies, standards, controls, and applicable regulatory requirements. Coordinate audits, assessments, control reviews, risk evaluations, maturity assessments, executive reporting, and security roadmap activities to strengthen the brand’s security posture. Drive the adoption of GCS control frameworks, policies, and standards within the brand.

• Incident Remediation & Vulnerability Management: Oversee and coordinate the identification, assessment, prioritization, remediation, validation, and closure of security vulnerabilities, audit findings, control deficiencies, risks, and cybersecurity incidents. Drive remediation governance through accountability, tracking, escalation, root cause analysis, corrective action planning, lessons learned, and vulnerability reduction reporting. Support Incident Remediation through GCS Security Operations processes at the onset and throughout the Incident Life-Cycle, as needed. Deliver a value-added perspective on behalf of the brand and GCS functions to enhance Vulnerability Management reporting and provide a foundation for truth in reporting. Drive vulnerability management remediation within the brand to reduce risks to acceptable levels established by GCS in conjunction with Brand leadership. Provide insight into Incident Response playbooks and ensure geographical nuances for respective brands are incorporated.

• GCS Service Delivery & Requirements Management: Serve as the primary representative and point of accountability for delivering current and future defined GCS services to the assigned brand or business unit. Gather, document, validate, prioritize, and communicate business, technology, security, compliance, and operational requirements to GCS and relevant corporate security domains. Champion the intake process and drive requirements gathering for GCS and Brand-specific initiatives.

• Business Advisory, Security Consulting & Solution Ownership: Act as a trusted security advisor and consultant to business and technology leadership. Partner collaboratively with brand stakeholders to identify issues, understand challenges, evaluate risks, and develop pragmatic, business-aligned security solutions while taking ownership for driving issues and initiatives through completion.

• Stakeholder Partnership & Cross-Functional Collaboration: Facilitate collaborative problem solving across brand teams, GCS security domains, technology organizations, legal, privacy, audit, compliance, maritime, operations, vendors, and other partners to align priorities, resolve barriers, and deliver intended security and business outcomes. Own and manage Change Management principles, including but not limited to partnership and communication, to promote GCS, Brand-specific, and overall company objectives.

• Leadership, Resource Planning & Security Culture: Build, lead, mentor, and develop individual contributors, teams, matrixed resources, project teams, and external partners. Lead according to company values, leadership principles, and expected behaviors, fostering accountability, collaboration, inclusion, integrity, engagement, professional growth, and high-performance outcomes.

• Metrics, Reporting, Budget & Continuous Improvement: Establish security metrics, executive dashboards, remediation and vulnerability management reporting, risk transparency, and service delivery measures. Support budgeting, forecasting, resource planning, vendor management, investment prioritization, and continuous improvement of GCS services and brand security maturity. Leverage, facilitate, and drive adoption of core metrics back to the brands.

Knowledge, Skills & Abilities:

• Strong knowledge of cybersecurity governance, risk management, compliance, privacy, data protection, security control frameworks, and regulatory requirements relevant to a global, complex organization.

• Practical understanding of IAM, GRC, security architecture, infrastructure security, application security, data security, cloud security, threat management, security operations, vulnerability management, incident response, incident remediation, business continuity, disaster recovery, and maritime / operational technology security where applicable.

• Strong consulting, advisory, stakeholder management, negotiation, influence, collaboration, facilitation, executive communication, and requirements-gathering skills, with the ability to translate complex technical and regulatory concepts into business-focused priorities and decisions.

• Demonstrated ability to define priorities, execute strategic initiatives, manage remediation, oversee vulnerability reduction, deliver GCS services, measure outcomes, and drive continuous improvement in security maturity.

• Strong ownership mentality with a focus on accountability, inclusive leadership, practical security enablement, collaborative solutioning, ethical conduct, and measurable business and security outc

• Strategic: Shape and recommend local security strategy, maturity priorities, security roadmaps, risk reduction plans, future GCS service adoption priorities, and investment priorities aligned to global security objectives and brand or business unit priorities.

• Tactical: Translate corporate policies, standards, domain requirements, collected brand or business unit requirements, and future defined GCS services into brand or business unit execution plans, resource plans, remediation priorities, reporting cadences and stakeholder commitments.

• Operational: Manage day-to-day security execution, issue escalation, vendor follow-up, incident coordination, remediation execution, vulnerability management follow-up, control implementation, status reporting, resource coordination and support for security SMEs.

For all roles:

• Knowledge: Understanding of workplace policies and procedures / Familiarity with team collaboration tools and techniques.

• Skills: Strong time management and organizational skills

• Abilities: Ability to maintain reliable and consistent attendance / Capacity to be punctual and meet deadlines / Ability to collaborate effectively with colleagues and work as part of a team / Demonstrated professionalism in all interactions and tasks.

Essential/Minimum qualifications:

• Bachelor’s degree in Information Security, Computer Science, Information Technology, Engineering, Business Administration, Business Informatics, or a related field required; equivalent work experience may be considered where appropriate. Master’s degree preferred. Professional certifications such as CISSP, CISM, CISA, CRISC, CCSP, GSLC, ISO 27001, C-CISO, or equivalent cybersecurity, risk, governance, or compliance certifications preferred.

Essential experience required:

• 10+ years of progressive experience within cybersecurity, information security, IT risk, governance, compliance, or technology leadership roles. Demonstrated experience leading enterprise security programs within large and complex organizations, including audits, compliance initiatives, incident response, incident remediation, vulnerability management, cyber risk programs, requirements management, service delivery, stakeholder engagement, and cross-functional delivery in a matrixed environment.

Travel: Less than 25% non-shipboard travel likely

Work Conditions: Work primarily in a climate-controlled environment with minimal safety/health hazard potential.

Physical Demands: Must be able to remain in a stationary position at a desk and/or computer for extended periods of time.

This position is classified as “in-office.” As an in-office role, it requires employees to work from a designated Carnival office in South Florida Monday through Thursday each week. Employees may work from their homes on Fridays. Candidates must be located in (or willing to relocate to) the Miami/Ft. Lauderdale area.

Offers to selected candidates will be made on a fair and equitable basis, taking into account specific job-related skills and experience.

At Carnival, your total rewards package is much more than your base salary. All non-sales roles participate in an annual cash bonus program, while sales roles have an incentive plan. Director and above roles may also be eligible to participate in Carnival’s discretionary equity incentive plan.Plus, Carnival provides comprehensive and innovative benefits to meet your needs, including:

• Health Benefits:
  • Cost-effective medical, dental and vision plans
  • Employee Assistance Program and other mental health resources
  • Additional programs include company paid term life insurance and disability coverage
• Financial Benefits:
  • 401(k) plan that includes a company match
  • Employee Stock Purchase plan
• Paid Time Off:
  • Holidays – All full-time and part-time with benefits employees receive days off for 8 company-wide holidays, plus 2 additional floating holidays to be taken at the employee’s discretion.
  • Vacation Time – All full-time employees at the manager and below level start with 14 days/year; director and above level start with 19 days/year. Part-time with benefits employees receive time off based on the number of hours they work, with a minimum of 84 hours/year. All employees gain additional vacation time with further tenure.
  • Sick Time – All full-time employees receive 80 hours of sick time each year. Part-time with benefits employees receive time off based on the number of hours they work, with a minimum of 60 hours each year.
• Other Benefits:
  • Complementary stand-by cruises, employee discounts on confirmed cruises, plus special rates for family and friends
  • Personal and professional learning and development resources including tuition reimbursement
  • On-site Fitness center at our Miami campus

#Corp

#LI-Hybrid

#LI-LS1

About Us

Carnival Corporation & plc is the world’s largest leisure travel company, our mission to deliver unforgettable happiness to our guest through our diverse portfolio of leading cruise brands and island destinations, including Carnival Cruise Line, Holland America Line, Princess Cruises, and Seabourn in North America and Australia; P&O Cruises and Cunard Line in the United Kingdom; AIDA in Germany; Costa Cruises in Southern Europe.

Join us and embark on a career that offers not only the chance to grow professionally but also the opportunity to be part of a global community that makes a difference.

In addition to other duties/functions, this position requires full commitment and support for promoting ethical and compliant culture. More specifically, this position requires integrity, honesty, and respectful treatment of others, as well as a willingness to speak up when they see misconduct or have concerns.

Carnival Corporation & plc and Carnival Cruise Line is an equal employment opportunity/affirmative action employer. In this regard, it does not discriminate against any qualified individual on the basis of sex, race, color, national origin, religion, sexual orientation, age, marital status, mental, physical or sensory disability, or any other classification protected by applicable local, state, federal, and/or international law.