Divisional Business Information Security Officer

About the role

CBRE is seeking a Divisional Business Information Security Officer (BISO), to join CBRE’s Global

Business Information Security team, and serve as a trusted advisor between cybersecurity and business operations. The individual will serve as a catalyst for aligning security with business goals, contributing to the overall success of CBRE. At a high level, the BISO plays a valuable and pivotal role in the following key objectives:

• Execution of corporate cybersecurity strategy within the assigned division, in alignment with the business needs and regulatory environment,

• Reduction of cybersecurity risk,

• Facilitation of cyber risk-based decision-making,

• Enablement of the business, through alignment of security products and services with business objectives.

• Addressing security-related business challenges,

• Promoting the security culture.

Communication &

Collaboration:

BISOs serve as a liaison between cybersecurity and the business as well as between cybersecurity and technology teams that support the business. In that role, BISOs facilitate effective communication between the various teams while also communicating with other critical partners (i.e. legal, risk teams, internal audit, etc.) including the following:

• Provide regular briefings to divisional leadership on security posture, risks, and risk reduction/mitigation efforts.

• Bring ‘voice of the business’ insights to the CISO, Global BISO and the broader Global

• Cybersecurity Office to drive business awareness with cyber teams and partner on improvements.

• Collaborate with Global BISO, Cyber Incident Response, Security Operations Center and

• Client Assurance teams, in response to division-specific security incidents, coordinating with broader security, technology, legal, compliance and corporate communication teams, as needed.

• Drive cyber control adoption, as well as remediation of cybersecurity issues (including audit findings, regulatory compliance items, contractual compliance issues, regulatory compliance requirements) and cybersecurity control gaps through coordination of and communication of remediation plans.

• Assist the CBRE Client Assurance team with division-related client requests by providing business insights and leveraging your knowledge of the business to connect the team with appropriate stakeholders.

A key focus of BISOs is to assist with cybersecurity risk management. BISOs, in partnership with Cybersecurity Governance, Risk & Compliance teams as well as Enterprise Risk Management, assist with identification, assessment, mitigation and overall reduction of cybersecurity risk.

• Assist with risk analysis and assessment, identifying potential security threats, and developing mitigation strategies tailored to the business risk profile and specific business needs.

• Translate corporate security policies, standards and cyber-related regulatory requirements into actionable plans for the assigned division, ensuring awareness within the business and assisting to drive adherence to policies, standards and compliance requirements.

• Assist with development, implementation, and evolution of cybersecurity-related processes, including but not limited to application registration, cyber risk evaluation, cybersecurity control self-assessment processes while partnering with product and technology teams to drive successful and timely execution of these processes.

• Serve in a consulting/advising function to effectively identify relevant cybersecurity requirements (example – MFA, WAF, etc.) for new and existing projects/initiatives, in partnership with appropriate product teams and subject-matter experts, ultimately driving the implementation of security into the division’s products and services, balancing business needs with security requirements.

• Monitor the assigned division’s cybersecurity objectives and measures and assist the division’s business and technology teams with prioritization of cybersecurity-related efforts needed to address control adoption and/or operational control deficiencies.

BISOs promote a security culture where cybersecurity is valued as an enabler of the business. They serve as advocates for security best practices, cybersecurity strategy and programs with an understanding that cybersecurity policies and standards are purpose-built and not simply compliance requirements.

• Educate division staff on cybersecurity best practices, integration of cybersecurity controls, and importance of meeting targets for…