Business Information Security Officer (BISO), HPE Operations

Job Description:

About Our Cybersecurity Team

Are you ready to make an impact at one of the world’s leading technology companies?

At HPE, cybersecurity is embedded in how we operate, innovate, and serve our customers. Our Cybersecurity & Digital Risk Management (CDRM) organization partners across HPE to reduce risk, improve resilience, and enable secure business outcomes.

We are looking for an experienced cybersecurity leader to serve as the Business Information Security Officer for HPE Operations. You will shape and build how cybersecurity partners with Operations—creating practical solutions, introducing new ways to identify and reduce risk, and bringing together business and cybersecurity teams to drive measurable risk reduction outcomes.

If you are energized by building something new, challenging established approaches, and helping leaders make informed decisions at scale, we would like to hear from you.

As the Business Information Security Officer for HPE Operations, you will be a highly visible senior individual contributor reporting to the VP and Head of Office of the CISO with in the global cybersecurity organization, with a dotted line to HPE Operations leadership. HPE Operations oversees the delivery of products and services across HPE, including a global supply chain which ships 58 terabytes of storage and two servers every 60 seconds to customers around the world.

Working closely with HPE Operations, the Cybersecurity Third-Party Risk team, and other CDRM functions, you will help improve risk visibility, clarify accountability, support timely risk reduction, and facilitate informed business decisions. You will lead through influence, establish effective relationships across a complex global organization, and translate technical and risk matters into clear business impact, practical options, and actionable recommendations.

You will be responsible for:

• Serving as the primary cybersecurity liaison and trusted advisor for HPE Operations.
• Building effective relationships with Operations leaders and developing a strong understanding of their strategic priorities, critical processes, dependencies, and risk landscape.
• Partnering with Operations leaders to enable business initiatives through practical, proportionate, and risk-informed cybersecurity guidance.
• Translating complex cybersecurity, technology, operational, and third-party risks into clear business impact, options, recommendations, and decision points.
• Partnering with the Cybersecurity Third-Party Risk team and Operations stakeholders to identify, assess, communicate, and manage supplier, vendor, and ecosystem risks that could affect operational performance, resilience, or security.
• Partnering with the Cybersecurity Vulnerability Management team and Operations stakeholders to identify, assess, communicate, and mitigate vulnerabilities that could affect operational performance, resilience, or security.
• Facilitating cybersecurity risk reviews, security assessments, prioritization discussions, and remediation planning with accountable business and cybersecurity stakeholders.
• Establishing clear ownership of identified risks and supporting appropriate escalation, governance, and follow-through for agreed remediation actions.
• Facilitating risk-based decision-making, including the clear documentation and escalation of accepted or residual risks when remediation is not practical, timely, or proportionate.
• Supporting operational resilience by helping ensure appropriate cybersecurity controls and recovery considerations are incorporated into critical operational processes and dependencies.
• Coordinating business engagement during significant cybersecurity incidents, including stakeholder communication, decision support, business impact assessment, escalation, recovery, and post-incident follow-through.
• Monitoring emerging cybersecurity, operational, third-party, legal, and regulatory risks relevant to HPE Operations and communicating their potential business impact.
• Partnering across CDRM, including Governance, Risk & Compliance, Architecture & Engineering, Identity and Access Management, Product Security and Cyber Defense, as well as Legal and Privacy, to deliver coordinated outcomes.
• Tracking agreed risk-reduction activity and providing transparent visibility of progress, accountable owners, blockers, decisions, dependencies, and residual risk.
• Helping establish and continuously improve the engagement model between HPE Operations, CDRM, and the Cybersecurity Third-Party Risk team.

You are an experienced cybersecurity or risk professional who can operate effectively at the intersection of business strategy, operations, technology, and cybersecurity.

You bring strong business judgement, executive communication skills, and the ability to build credibility with senior leaders. You are comfortable working independently in a fast-paced, global environment and can provide direction across complex, cross-functional initiatives without relying on direct authority.

You can evaluate complex or ambiguous situations, identify practical options, and help stakeholders reach well-informed decisions. You communicate technical and risk issues clearly to non-technical audiences and balance security requirements with operational priorities and business objectives.

• 10+ years of experience in cybersecurity, information security, enterprise risk management, compliance, operational risk, technology risk, or a related discipline.
• Experience partnering directly with senior business and operational leaders in a large, complex, global organization.
• Strong understanding of enterprise cybersecurity principles, risk management practices, security controls, and governance frameworks.
• Experience supporting third-party risk management, supply-chain risk, and / or operational risk programs.
• Experience working with global regulatory, legal, privacy, or contractual cybersecurity requirements.
• Demonstrated ability to translate complex technical, cybersecurity, and risk issues into clear business language, practical options, and actionable recommendations.
• Experience facilitating risk reviews, documenting risk decisions, establishing accountable ownership, and tracking remediation or risk-treatment activity.
• Experience preparing and presenting cybersecurity, risk, compliance, or resilience matters to executive and senior leadership audiences.
• Strong stakeholder management, influencing, consulting, and cross-functional leadership skills.
• Demonstrated ability to lead through influence and drive outcomes without direct authority.
• Strong written and verbal communication skills, including the ability to prepare concise executive briefings and reports.
• Sound judgement and the ability to operate effectively in complex, ambiguous, or rapidly changing situations.
• Ability to balance cybersecurity risk reduction with operational priorities and business objectives.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business, or a related field, or equivalent practical experience.
• Relevant cybersecurity, risk, audit, or information security certification is desirable, such as:
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Security Manager (CISM)
  • Certified in Risk and Information Systems Control (CRISC)
  • Certified Information Systems Auditor (CISA)
  • ISO 27001-related certification
  • An equivalent recognized professional qualification

• Experience working with operations, supply chain, manufacturing, global services, procurement, logistics, or other enterprise business functions.
• Experience supporting large-scale business, operational, technology, or digital transformation initiatives.
• Familiarity with recognized cybersecurity and risk frameworks, such as the NIST Cybersecurity Framework, ISO/IEC 27001, and CIS Controls.
• Experience supporting cybersecurity incident response, crisis management, business continuity, disaster recovery, or operational resilience.
• Experience establishing or improving a BISO, cybersecurity business-partnering, or security engagement model.
• Understanding of technology, supplier, and ecosystem dependencies within complex operational environments.

Success in this role will be demonstrated when:

• HPE Operations leaders recognize the BISO as a trusted, practical, and credible cybersecurity partner.
• Cybersecurity and third-party risks are identified earlier and translated into clear business impact, accountable ownership, and timely decisions.
• Priority risks have proportionate treatment plans, accountable owners, agreed target outcomes, and visible progress.
• Risk acceptance and residual-risk decisions are clearly documented, appropriately governed, and escalated when required.
• Engagement between CDRM, HPE Operations, and the Cybersecurity Third-Party Risk team is consistent, proactive, and supports timely risk-based decision-making.
• Executive reporting provides concise visibility of material risks, business impact, decisions required, progress, blockers, and residual exposure.
• Cybersecurity considerations are incorporated into key operational initiatives and decisions without creating unnecessary business friction.
• The role supports measurable risk reduction while enabling HPE Operations to deliver its strategic and operational priorities.

Accessibility

HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked here.

Note: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.

Health & Wellbeing

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

Personal & Professional Development

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

Unconditional Inclusion

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

Job:

Job Level:

Information about employee benefits offered in the US can be found at https://myhperewards.com/main/new-hire-enrollment.html

Hewlett Packard Enterprise is EEO Protected Veteran/ Individual with Disabilities.

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories.

Recruitment Fraud Alert

We have become aware of an increase in fraudulent recruitment activities in which individuals impersonate our company or authorized recruitment agencies to offer fake employment opportunities. These scams may occur through false websites, emails, social media, or chat-based applications and often aim to obtain personal information or money. Please note that Hewlett Packard Enterprise (HPE), its direct and indirect subsidiaries and affiliated companies, and its authorized recruitment agencies/vendors will never charge a candidate a registration fee, hiring fee, or any other fee in connection with its recruitment and hiring process. We also never request personal information such as back account details, Social Security numbers, or national IDs via social media or chat applications.

All legitimate job opportunities will come through official company channels, and candidates are responsible for verifying the credentials of any third party claiming to represent the company. Any reliance on fraudulent communication is at the individual’s own risk, and HPE disclaims legal liability for any resulting damages. If you suspect recruitment fraud, do not share personal information or make any payments and report the incident to your local authorities immediately.