Principal Information Security - Identity and Data Security

Innovate with purposeAt BILL, we believe in empowering the businesses that drive our economy. By replacing outdated financial processes with innovative tools, we help businesses—from startups to established brands—make smarter decisions and gain control of their operations. And we don’t stop there: we’re creating the future of financial automation so businesses can spend more time on what matters.Working here means you become part of a vision-driven team that’s ready to tackle challenges and build cutting-edge solutions. We value purpose, drive, and curiosity—and we thrive in a fast-paced, ever-changing environment. We're remote-first, with office spaces in San Jose, CA and Draper, UT — and opportunities to connect in person when it counts. BILLders collaborate to deliver real impact for businesses that need more time in their busy weeks.BILL builds high performing teams and we seek to hire the best talent for every role. We're committed to building a workplace that fosters inclusion and diverse perspectives, valuing each person’s unique skills and experiences. We’d love to hear from you—you might be just what we’re looking for, whether in this role or another. Let’s give businesses more time for what matters.Make your impact within a rapidly growing Fintech CompanyAs part of our Identity and Data Security team, you will be accountable for the strategy, security, and governance of digital identities—both human (employees, contractors, business partners) and non-human (agents, bots, service accounts, IoT). In addition, this role will oversee and coordinate BILL’s governance, risk, compliance (GRC), and remediation activities related to data security. This position will report directly to the Security GRC Leader. This role addresses all aspects of administration, enforcement, compliance, education, investigation, and contingency planning related to identity and data security, aligning with stakeholders in IT, Privacy Legal, Internal Audit, and Engineering teams to ensure BILL’s rigorous data control standards are met. This role is a hands-on IC security leader role with the expectation that work will vary between strategic and operational.Responsibilities:This job description intends to provide an overview of the general nature of the work and is not intended to reflect an exhaustive listing of responsibilities or requirements. The company reserves the right to update, modify, discontinue, or change the requirements of any job as determined by business needs with or without prior notice.Serve as a bridge between technical teams (like IT and Security) and executive leadership, turning complex risk landscapes into clear business insights.Implement measures and governance frameworks to manage data use in compliance with laws and regulationsMonitor the regulatory and statutory landscape on identity and data security issues, keeping BILL personnel and senior leadership apprised of any relevant developments impacting the company’s business goals and objectives, and recommending appropriate courses of action as neededReview projects, business critical systems and provide guidance and work with process owners to identify and remediate control weaknesses related to identity and data security to ensure compliance with regulatory requirements and ensure client contractual commitments and industry best practicesDevelop and advance the multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, technology evolution, and the maturity and effectiveness of existing IAM capabilitiesOversee Identity Governance and Administration (IGA) processes—managing new hires, transfers, and terminations to ensure least-privilege access across the entire enterprise.Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Adaptive Access policies that determine how users log in and what context-aware security checks are applied.Secure high-risk privileges for administrators and service accounts to prevent lateral movement during a breach.Provide security strategy and guidance for customer-facing identity capabilities, including authentication, secure registration, profile management, federated/social login, in partnership with Product and Engineering.Assess and evolve security requirements for non-human identifies, including service accounts, APIs, AI agents, with appropriate authentication, authorization, least privilege, monitoring and accountability. Assess sensitive-data security risks and the effectiveness of related controls, leveraging data discovery and DLP capabilities to strengthen protection and prevent inappropriate access or use. Advance data governance and protection by improving visibility into sensitive data across the ecosystem, such as data inventory, classification, security controls, retention and appropriate use across product environments, corporate environments, third parties and AI enabled use cases. We would love to chat if you have:Bachelor’s degree in cyber security (or) related degree or equivalent work experience10-15 years of experience in Information Security with significant experience in identity security and/or data security, and demonstrated experience identifying systemic gaps and applying risk, control and governance principles to mature security capabilities.Certified Information Security Systems Professional (CISSP), Certified Information Security Manager (CISM) or Global Information Assurance Certifications (GIAC) certifications are preferredExperience assessing security risks and control effectiveness, applying and evolving risk scoring methodologies in alignment with risk appetite and influencing stakeholders to prioritize appropriate risk-reduction actions.Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority.Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models, with experience across workforce, privileged, non-human, and AI enabled identities. Strong expertise in data security and governance, including data discovery and inventory, classification, access, handling, protection, retention and secure disposal. Ability to align security and compliance objectives with the broader business goals and growth strategy, developing and executing multi-year security strategies and roadmapsProven track record of scaling GRC, identity, and/or data security programs.Deep knowledge of frameworks such as NIST, ISO 27001, and various regional/industry-specific regulations.Effectively partner cross-functionally with Legal, HR, Finance, Engineering and IT to embed risk management into day-to-day operations.Lead teams (directly or indirectly) to automate access request workflows to reduce manual overhead and human error.Experience with enterprise platforms like AWS, Okta, AD, MS Azure, Lumos, etc.Hands on experience with Access Management workflows for all identity transactions (Moves, Adds, Transfers, and Changes)#LIThe estimated salary range for this role is noted below for our San Jose based role. Our ranges for each role and job level are based on a variety of factors including candidate experience, expertise, and geographic location and may vary from the amounts listed above. The role is also eligible for a competitive benefits package that includes: medical, dental, vision, life and disability insurance, 401(k) retirement plan, flexible spending & health savings account, paid holidays, paid time off, and other company benefits.San Jose pay range$243,200—$304,000 USDThe On Target Earnings (OTE) range for this role is noted below for our office location in Draper, UT. This role is eligible to participate in BILL’s sales incentive and equity plans. Our ranges for each role and job level are based on a variety of factors including candidate experience, expertise, and geographic location and may vary from the amounts listed above. The role is also eligible for a competitive benefits package that includes: medical, dental, vision, life and disability insurance, 401(k) retirement plan, flexible spending & health savings account, paid holidays, paid time off, and other company benefits.Draper UT pay range$206,700—$258,400 USDWhat’s in it for you? Redefining how businesses automate their work is a fast-paced, exciting, and fun environment. But we also have benefits and perks to ensure the magic isn’t only experienced by our customers, but by our employees as well. Here is a preview of some of the amazing benefits here at BILL: 100% paid employee health, dental, and vision plans (choose HMO, PPO, or HDHP)HSA & FSA accounts Life Insurance, Long & Short-term disability coverageEmployee Assistance Program (EAP)11+ Observed holidays and wellness days and flexible time off Employee Stock Purchase Program with employee discountsWellness & Fitness initiativesEmployee recognition and referral programsAnd much moreDon’t believe us? Check out our culture, benefits, and teams on our career site, LinkedIn Life, or YouTube pages.BILL is an Equal Opportunity Employer. We believe our best ideas come from the unique stories, perspectives, and experiences of our team members. We welcome people of all backgrounds, abilities, and identities to bring their authentic selves and contribute to our culture.We are committed to a transparent, inclusive hiring process that reflects our values. If you need accommodations at any stage, please contact View email address on click.appcast.io. To ensure a fair evaluation, our Candidate Integrity Policy prohibits the use of unapproved external assistance, including generative AI, during live interviews or assessments. Doing so will result in a review and potential disqualification.Our Applicant Privacy Notice describes how BILL treats the personal information it receives from applicants.