Sr. Cloud Security Controls Governance Manager Denver, Colorado;Washington, District of Columbia; Chicago, Illinois **Job Description:** At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. Responsible Growth is how we run our company and how we deliver for our clients, teammates, communities and shareholders every day. One of the keys to driving Responsible Growth is being a great place to work for our teammates around the world. We’re devoted to being a diverse and inclusive workplace for everyone. We hire individuals with a broad range of backgrounds and experiences and invest heavily in our teammates and their families by offering competitive benefits to support their physical, emotional, and financial well-being. Bank of America believes both in the importance of working together and offering flexibility to our employees. We use a multi-faceted approach for flexibility, depending on the various roles in our organization. The Cloud Security Controls Governance Manager is responsible for implementing, managing, and governing security controls across multi-cloud environments, with a specific emphasis on Azure and AWS platforms, to ensure the protection of organizational data and systems. This role requires deep expertise in cloud security, architecture principles, and industry standards. The ideal candidate will work closely with various teams to ensure the security of cloud-based applications, data, and infrastructure, particularly on platforms like AWS and Azure. Will manage a team of 5-7. Key Responsibilities: - Manages a team responsible for executing the cloud security reviews for bank managed cloud environments - Provides oversight of internal and external stakeholder relationships, including Line of Business delegates and regulators, to mitigate and remediate information security risks - Ensures Information Technology systems meet enterprise standards, adhere to applicable rules, laws, and regulations, and comply with appropriate treatment of risk - Works with leaders to identify information security policy impacts to front line units - Develop and implement security controls for cloud infrastructure (IaaS, PaaS, SaaS) based on industry best practices, compliance requirements, and bank security policies. - Ensure appropriate security measures are in place to protect against threats, vulnerabilities, and breaches in Azure and AWS environments. - Develop and maintain documentation for cloud security controls, policies, and procedures. - Monitor and evaluate the effectiveness of existing cloud security controls and recommend enhancements. - Conduct regular security assessments and audits of cloud environments to identify and mitigate potential security threats and vulnerabilities in cloud environments. - Participate in internal and external audits to demonstrate compliance with cloud security requirements. - Provide guidance and training to stakeholders on cloud security best practices and the implementation of security controls. - Act as a liaison between the security team and other departments to promote a security-first culture. - Collaborate with DevOps, IT, and business teams to integrate security controls into cloud deployments and CI/CD pipelines. - Stay current with emerging cloud security trends, technologies, and best practices. - Continuously improve security controls and processes to enhance the organization's security posture. Required Skills: - In-depth understanding of cloud security principles, best practices for Azure and AWS platforms, and industry frameworks such as OWASP Top 10, NIST, CSA, CIS benchmarks. - Experience building and implementing Infrastructure as Code and/or Policy as Code governance strategies. - Experience conducting security assessments, risk analyses, and developing security concepts. - Hands-on experience with cloud security tools and technologies such as AWS Security Hub, Azure Security Center, Google Cloud Security Command Center, and/or Wiz. - Extensive knowledge of security tools and technologies such as SIEM, IDS/IPS, DLP, firewalls, PKI, and identity management and how they work in cloud environments. Specifically in network security, including AWS networking primitives, security groups, network access control lists, proxies, firewall and WAF technologies. - Experience with cloud and containerized technologies, AKS, EKS, ECS, serverless, Kubernetes and Docker - Extensive knowledge of public cloud service providers and the threats to workloads within those environments - Currently hold active AWS Security Specialty or Azure AZ-500 certification Desired Skills: - Master’s degree in Information Systems or Computer Science and/or equivalent combination of education and work experience within the domain areas of Cloud Security - Relevant industry certifications such as ISC2 and SANS GIAC are highly desirable. - Strong communication and interpersonal skills to work effectively with cross-functional teams. - Ability to manage multiple projects and priorities in a fast-paced environment. - Bachelor’s degree in Information Systems or Computer Science and/or equivalent combination of education and work experience within the domain areas of Cloud Security This job will be open and accepting applications for a minimum of seven days from the date it was posted. **Shift:** 1st shift (United States of America) **Hours Per Week:** 40 **Pay Transparency details** US - CO - Denver - 1144 15th St (CO9926), US - DC - Washington - 1800 K St NW - 1800 K Street NW (DC1842) Pay and benefits information Pay range $160,000.00 - $185,100.00 annualized salary, offers to be determined based on experience, education and skill set. Discretionary incentive eligible This role is eligible to participate in the annual discretionary plan. Employees are eligible for an annual discretionary award based on their overall individual performance results and behaviors, the performance and contributions of their line of business and/or group; and the overall success of the Company. Benefits This role is currently benefits eligible. We provide industry-leading benefits, access to paid time off, resources and support to our employees so they can make a genuine impact and contribute to the sustainable growth of our business and the communities we serve. Bank of America and its affiliates consider for employment and hire qualified candidates without regard to race, religious creed, religion, color, sex, sexual orientation, genetic information, gender, gender identity, gender expression, age, national origin, ancestry, citizenship, protected veteran or disability status or any factor prohibited by law, and as such affirms in policy and practice to support and promote the concept of equal employment opportunity and affirmative action, in accordance with all applicable federal, state, provincial and municipal laws. The company also prohibits discrimination on other bases such as medical condition, marital status or any other factor that is irrelevant to the performance of our teammates. To view the "EEO is the Law" poster, CLICK HERE (https://www.dol.gov/ofccp/regs/compliance/posters/pdf/eeopost.pdf) . To view the "EEO is the Law" Supplement, CLICK HERE (https://www.dol.gov/ofccp/regs/compliance/posters/pdf/OFCCP\_EEO\_Supplement\_Final\_JRF\_QA\_508c.pdf) . View the LA County Fair Chance Ordinance (https://dcba.lacounty.gov/wp-content/uploads/2024/08/FCOE-Official-Notice-Eng-Final-8.30.2024.pdf) . Bank of America aims to create a workplace free from the dangers and resulting consequences of illegal and illicit drug use and alcohol abuse. Our Drug-Free Workplace and Alcohol Policy (“Policy”) establishes requirements to prevent the presence or use of illegal or illicit drugs or unauthorized alcohol on Bank of America premises and to provide a safe work environment. To view Bank of America’s Drug-free Workplace and Alcohol Policy, CLICK HERE . This communication provides information about certain Bank of America benefits. Receipt of this document does not automatically entitle you to benefits offered by Bank of America. Every effort has been made to ensure the accuracy of this communication. However, if there are discrepancies between this communication and the official plan documents, the plan documents will always govern. Bank of America retains the discretion to interpret the terms or language used in any of its communications according to the provisions contained in the plan documents. Bank of America also reserves the right to amend or terminate any benefit plan in its sole discretion at any time for any reason.