Sr. Business Information Security Officer; BISO

Department: Information Technology – Enterprise Security
Location: Grapevine, TX or Cranberry Township, PA (Remote)

The Sr. Business Information Security Officer (BISO) serves as the primary bridge between Omnicell’s Enterprise Security Team and designated lines of business and functions. This role helps business units understand, adopt, and operationalize security policies and processes in a way that enables secure growth while meeting regulatory, customer, and audit expectations.

• Aligns security priorities with business strategies and go‑to‑market plans.
• Translates technical risk into clear business and regulatory impact for leaders.
• Simplifies and integrates security into processes, projects, and technology initiatives.
• Builds trust and credibility with executives, product teams, IT, Legal, and Privacy.

The BISO partners closely with Enterprise Security pillars (Cyber Architecture & GRC, Sec Ops, Product/Cloud Security, IAM, Third‑Party Risk, Resilience), Privacy, Legal, and commercial, services, and operations leadership.

• Serve as the primary security liaison for designated business units and functions (e.g., commercial and service leadership, operations, and enabling functions).
• Participate in business reviews, portfolio planning, and steering committees to ensure security and privacy requirements are identified early.
• Provide clear, risk‑based guidance on new initiatives (e.g., product launches, SaaS and cloud deployments, integrations, use of AI, new market segments), documenting recommended controls and trade‑offs.
• Help business leaders balance growth, customer expectations, and regulatory obligations with Omnicell’s security, privacy, and compliance standards.

• Ensure business units operate within Omnicell’s Global Cybersecurity Policy Suite, Enterprise Security Policy, and supporting standards (e.g., IAM, Network Security, Data Protection, Incident Response, Third‑Party Risk).
• Interpret global policies in the context of regulations and frameworks (e.g., HIPAA/HITECH, HITRUST, SOC 2, state privacy laws such as CCPA/CPRA, payer/provider security requirements).
• Maintain a documented security engagement model for stakeholders, including RACI for key controls, decision rights, and escalation paths.
• Represent the security risk posture and control maturity in enterprise security and IT risk governance forums.

• Maintain a security risk register aligned with NIST CSF v2.0, Omnicell’s risk taxonomy, and enterprise risk processes.
• Coordinate or lead risk and privacy impact assessments for systems, data flows, and business processes, in partnership with Privacy, Legal, Product, and IT.
• Translate assessment findings into corrective action plans (CAPs) with clear owners, timelines, and mapping to applicable control frameworks (e.g., NIST CSF, NIST 800‑53, HITRUST, SOC 2, Omnicell policies, and relevant regulations).
• Contribute data to enterprise security metrics and dashboards (e.g., vulnerabilities, incident trends, IAM metrics, training completion) and help drive remediation and continuous improvement.

• Embed security into programs and projects (e.g., cloud migrations, data center moves, partner integrations, major customer programs, M&A integrations, and divestitures) by ensuring requirements are captured and designs align with enterprise reference architectures and policies.
• Partner with Product/Cloud Security and IT to ensure hosted workloads follow standards across segmentation, logging, IAM, PAM, CSPM, DLP, EDR, and related controls.
• Support data classification and handling for operations, ensuring that confidential information, PHI, and PII are managed per Omnicell policies and applicable US laws and regulations.
• Promote and coordinate security training and awareness tailored for audiences (commercial, operations, support, engineering, and partners).

• Support customer security assessments, RFPs, due diligence, and contract negotiations for opportunities,…