Senior Director, Business Information Security Officer (BISO)

Senior Director, Business Information Security Officer (BISO) – Product & Engineering Location: Sunnyvale, CA • Department: Information Security • Reports to: Chief Information Security Officer (CISO). Job Summary The Senior Director, Business Information Security Officer (BISO) for Product & Engineering is a senior leadership role responsible for driving security alignment, governance, and risk management across Proofpoint’s product and engineering organizations. This role serves as a trusted advisor and strategic partner to Product and Engineering leadership, ensuring that security policies, standards, and risk‑management practices are effectively defined, adopted, and operationalized within the software development lifecycle, enabling secure‑by‑design product development at scale. Key Responsibilities Strategic Security Partnership with Product & Engineering Act as the primary security advisor to Product Management and Engineering leadership. Align enterprise security strategy with product roadmaps, architecture decisions, and engineering priorities. Ensure security considerations are incorporated early in product design and planning processes. Translate technical security risks into product, customer, and business impact to support decision‑making. Security Policy, Standards & Governance Define and maintain product and application security policies, standards, and guardrails aligned with industry best practices. Establish clear security requirements for the SDLC, including secure coding, testing, and release expectations. Partner with Product & Engineering to operationalize these standards within developer workflows and tooling. Drive consistent adoption and enforcement of security policies across all product teams. Product Security Risk Management & Oversight Establish a product‑centric risk‑management framework, including risk identification, prioritization, and reporting. Ensure product and engineering teams appropriately assess, prioritize, and remediate vulnerabilities and design risks. Provide governance over risk acceptance decisions, ensuring alignment with business risk tolerance. Deliver clear visibility of product security risk posture to executive leadership. Secure Development Enablement Promote adoption of secure‑by‑design and secure‑by‑default principles. Ensure integration of security practices into SDLC and CI/CD pipelines (e.g., threat modeling, SAST/DAST, code reviews). Advocate for scalable security tooling and automation that align with engineering workflows. Monitor and report on adherence to secure development standards. Security Architecture & Design Influence Provide security guidance on product and platform architecture decisions. Promote use of secure design patterns, reference architectures, and reusable controls. Partner with engineering teams to evaluate and securely adopt new technologies, including cloud‑native and AI/GenAI capabilities. Security Incident & Vulnerability Governance (Product‑Focused) Act as the business‑facing security lead during significant product‑related vulnerabilities or incidents. Ensure effective coordination and communication between security teams and product/engineering stakeholders. Provide oversight on prioritization and remediation of critical vulnerabilities. Cross‑Functional Collaboration Build strong partnerships with Product Management, Engineering, Product Security, GRC, and Security Operations. Ensure security requirements are clearly defined, understood, and actionable within engineering processes. Act as the translation layer between technical security teams and business/product leadership. Customer Trust & Product Security Representation Partner with Product and GTM teams to represent Proofpoint’s product security posture in customer engagements. Support security reviews, audits, and customer inquiries related to product security. Ensure alignment between product security practices and customer expectations. Innovation & Emerging Technologies Stay current with emerging threats and vulnerabilities relevant to SaaS and cloud‑native products. Ensure new product initiatives (e.g., AI/GenAI) incorporate appropriate security controls and governance. Drive continuous improvement of product security practices through feedback and insights from the business. Leadership & Influence Lead through influence across product and engineering organizations without direct ownership of delivery teams. Foster a culture where security is embedded into product quality and engineering excellence. Drive accountability for security outcomes through governance, transparency, and partnership. Qualifications Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field. 10+ years of experience in cybersecurity, with strong exposure to product/application security and engineering engagement. Proven experience working in or alongside product and engineering organizations in a SaaS or cloud environment. Deep understanding of Secure SDLC and DevSecOps practices, Application security (OWASP Top10, threat modeling, secure coding), Vulnerability management and security testing tools (SAST, DAST, IAST). Strong ability to translate technical risks into product, customer, and business impact. Experience influencing cross‑functional teams without direct authority. Experience with regulatory frameworks such as SOC2, ISO27001, and similar standards. Relevant certifications (CISSP, CISM, or CSSLP) preferred. Compensation & Benefits Competitive compensation commensurate with market. Comprehensive benefits package. Flexible work environment and Work from Anywhere options. Annual wellness and community outreach days. Additional paid volunteer and wellbeing days. We encourage applications from individuals of all backgrounds, experiences, and perspectives. If you need accommodation during the application or interview process, please reach out to View email address on click.appcast.io. Proofpoint is an equal opportunity employer, we hire without consideration to race, religion, creed, color, national origin, age, gender, sexual orientation, marital status, veteran status or disability. #J-18808-Ljbffr