Application DeadlineApplications will be accepted through 11/19/26, after which we will begin candidate review. If the deadline is extended, we will update this posting.
Overview of RoleReporting to the Director of Business Systems and IT, the Information Security Lead coordinates and advances BOA's global cybersecurity program, focusing primarily on Information Systems Governance/Risk/Compliance (GRC) and day-to-day security operations.
Working closely with IT Operations and Business Systems Analysts, this position supports the development and execution of BOA's security roadmap, maintains security policies and controls, coordinates security assessments and audits, tracks identified risks, and drives remediation activities.
The role combines security program coordination with hands-on operational responsibilities, including triaging security alerts, supporting incident response, facilitating access reviews, managing vulnerability remediation workflows, and delivering employee security awareness initiatives.
Core Responsibilities- Reflect and role model BOA's vision, values and Leadership Model and demonstrate passion for our mission across the IT team and rest of the organization
- Support the development and execution of BOA's information security strategy and multi-year roadmap in partnership with the Director of Business Systems and IT.
- Assess security program maturity using NIST CSF 2.0; coordinate annual independent security assessments and audits; document, prioritize, and track findings through remediation closure.
- Develop and maintain enterprise security policies, standards, and procedures; manage the information security risk register, risk management plans, and documented exception process across global operations.
- Oversee identity and access governance, including periodic user access reviews, privileged access oversight, and segregation of duties (SoD), providing an independent control-review perspective.
- Serve as the primary information security contact for internal and external auditors; coordinate control evidence and support SOX ITGC testing and remediation.
- Manage third-party cyber risk through vendor assessments, review of vendor security reports and other assurance materials, and follow-up on identified gaps.
- Lead global security awareness initiatives, including phishing simulations and practical guidance on social engineering, data protection, and secure use of software systems and tools.
- Lead the vulnerability management process: evaluate exposure and business impact, establish remediation priorities and timelines, coordinate with IT Operations, and verify corrective actions.
- Oversee security monitoring coverage and investigate or triage security alerts, events, and tickets; collaborate with external security service providers and internal technical teams as needed.
- Maintain and exercise incident response procedures; coordinate investigations, escalation, containment, recovery, and lessons learned. Partner with IT Operations on disaster recovery exercises and resilience testing.
- Define and report meaningful security metrics, control effectiveness, program progress, and material risks to IT and company leadership; advise on security requirements for technology and business initiatives.
- Monitor relevant cyber threats, regulatory developments, and security practices; recommend pragmatic improvements suited to BOA's risk profile.
Required Qualifications- Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field, or an equivalent combination of education and experience.
- 5+ years of professional experience in information security, IT risk management, or IT operations with significant security responsibilities.
- Practical experience applying recognized security frameworks, such as NIST CSF 2.0, CIS Controls, or ISO/IEC 27001, to risk assessments, policies, controls, and program improvement.
- Working knowledge of Windows, macOS, and Linux environments, and Microsoft security and identity technologies, including Microsoft 365, Azure, Active Directory, Microsoft Entra ID, Intune, and Microsoft Defender.
- Hands-on proficiency in monitoring and triaging security alerts, investigating potential threats, and initiating appropriate incident response actions.
- Solid understanding of networking, identity and access management, and on-premises and cloud infrastructure security fundamentals.
- Strong communication, organizational, and analytical skills, with the ability to coordinate security initiatives across technical teams, departments, and 3rd parties.
Desired Qualifications- Relevant industry certifications, such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC)
- Experience improving security monitoring, incident response, tabletop exercises, or business continuity and disaster recovery readiness.
- Experience coordinating security or compliance audits, preparing control evidence, performing access reviews, or supporting SOX ITGC activities.
- Experience in a global, multi-site manufacturing, distribution, or consumer products organization.
Overview of Compensation and Benefits - Budgeted salary range: $105,000 - $125,000
- We will determine salary based on skills and experience in relation to the function of the role, as well as equity to any other employees with similar experience in the same or similar role
- This role is also eligible for a 10% annual bonus
- Comprehensive healthcare plans including Medical, Dental and Vision
- All plans include subsidization from BOA, with one option 100% subsidized by BOA
- BOA also funds HSA accounts for enrolled employees
- 3 weeks PTO to start, paid family leave, sick leave, and volunteer time off
- Matching 401K retirement plan
- Annual cash benefits for fitness, wellness, and BOA products
- Eligibility for stock options within 6 months of employment
- Scholarship opportunities for further education
- Flexible working schedule that includes both days at home and days in the office when needed
- Learning and development opportunities
- Discounts on many outdoor gear brands
- Dog-friendly office
Flexibility at BOA - BOA is committed to the health and well-being of our employees, and to upholding our values which include caring for each other and for our community
- At BOA we support both flexibility and connectivity
- For the majority of the Denver team, a hybrid approach is taken with the option to use a mix of remote work, and in-office connection days on Tuesdays and Thursdays. Connection Days are where we're all encouraged to go into the office and reconnect, even if you do not need to access specific equipment or product to do your job. Staying connected is really important, both for your mental health and to continue fostering our amazing BOA community
- Some roles will require 4-5 days/week in the office if access is needed to product, equipment, specialized technology etc. We will review any job-specific requirements during the interview process
Physical Considerations for RoleWe welcome any requests for reasonable accommodations. The information below is meant to provide a general overview of physical considerations, and if you believe you may need an accommodation, please provide more information in your application comments, or contact BOA People & Culture. The following considerations apply to this role:
☒ Regularly works in an office-based environment that is mostly comprised of sitting, and use of standard office equipment
