SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 243,200 - 304,000 / annual
BILL is a fintech company automating financial processes for businesses of all sizes. This Principal Information Security role leads the strategy, governance, and execution of identity and data security across the organization.
You will serve as a hands-on individual contributor and strategic leader, reporting to the Security GRC Leader. Your responsibilities span both human identities (employees, contractors, partners) and non-human identities (service accounts, APIs, AI agents, IoT). You will oversee governance, risk, compliance (GRC), and remediation activities related to data security, working cross-functionally with IT, Privacy/Legal, Internal Audit, and Engineering.
Key responsibilities include:
- Develop and advance multi-year identity security strategy and roadmap, prioritizing improvements based on risk, business needs, and technology evolution
- Oversee Identity Governance and Administration (IGA) processes for new hires, transfers, terminations, and least-privilege access management
- Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and adaptive access policies
- Secure high-risk privileges for administrators and service accounts to prevent lateral movement
- Provide security strategy for customer-facing identity capabilities (authentication, registration, federated/social login) in partnership with Product and Engineering
- Assess and evolve security requirements for non-human identities, including service accounts, APIs, and AI agents
- Assess sensitive-data security risks and control effectiveness using data discovery and DLP capabilities
- Advance data governance by improving visibility into sensitive data across product, corporate, third-party, and AI-enabled environments
- Serve as a bridge between technical teams and executive leadership, translating complex risk landscapes into clear business insights
- Implement governance frameworks for data use in compliance with laws and regulations
- Monitor regulatory and statutory landscape, keeping leadership apprised of developments impacting business goals
- Review projects and business-critical systems, identifying and remediating control weaknesses
The role is remote-first with primary office locations in San Jose, CA and Draper, UT, with opportunities to connect in person.
Requirements:
- Bachelor's degree in cybersecurity or related field, or equivalent work experience
- 10-15 years of information security experience with significant background in identity security and/or data security
- Demonstrated experience identifying systemic gaps and applying risk, control, and governance principles to mature security capabilities
- CISSP, CISM, or GIAC certifications preferred
- Experience assessing security risks and control effectiveness, applying risk scoring methodologies aligned with risk appetite
- Demonstrated ability to lead complex, cross-functional initiatives and influence stakeholders without direct authority
- Strong expertise in enterprise identity security, lifecycle, identity governance, and modern access control models (workforce, privileged, non-human, AI-enabled identities)
- Strong expertise in data security and governance (data discovery, inventory, classification, access, handling, protection, retention, disposal)
- Ability to align security and compliance objectives with broader business goals and growth strategy
- Proven track record of scaling GRC, identity, and/or data security programs
- Deep knowledge of frameworks such as NIST, ISO 27001, and regional/industry-specific regulations
- Ability to partner cross-functionally with Legal, HR, Finance, Engineering, and IT
- Experience leading teams (directly or indirectly) to automate access request workflows
- Hands-on experience with enterprise platforms (AWS, Okta, Active Directory, MS Azure, Lumos, etc.)
- Hands-on experience with Access Management workflows (Moves, Adds, Transfers, Changes)
