• Collaborate with internal departments on Client related matters and provide detailed feedback from Clients back to BCD Information Security and the business • Be the point of contact for complaints and escalate issues as appropriate • Coordinate and champion Security Request for Proposal(RFP) database repository • Lead the development of RFP responses and evaluate responses for accuracy • Create and facilitate responses to customer inquiries originating from RFP and assessments • Keep up to date Information security databases/repositories using Ombud, Archer, OneTouch or other tools and collect and maintain necessary audit evidence • Lead internal and external security communication efforts within BCD Travel, provide formal responses to customer security inquiries, complete and participate in Client security assessments and handle information security audits, risk remediation and mitigation efforts • Be knowledgeable on Artificial Intelligence (AI) and possess skills to sift through data using analytical tools and techniques • Collaborate with stakeholders to ensure AI aligns with organizational values and expectations • Ensure AI controls are aligned, validating output results to ensure accuracy and integrity of information • Identify and report on AI-related risks and concerns associated with internal AI use to support clients and business related assessments • Work with the development, business, sales and legal teams and advise on design and maintenance of effective information security controls compliant with ISO 27001, NIST 800-53, PCI, SOC, GDPR • Support the Information Security goals and challenges of our organization by providing a bridge from the centralized security function to the business, and assist with creation of applicable standard operating procedures

• Monitor, analyze and report on cybersecurity activities and trends in IT and information security systems • Conduct vulnerability assessment of information systems and provide recommendations for risk prioritization • Coordinate with relevant teams to validate network alerts • Analyze network traffic to identify potential threats • Use cyber defense tools to analyze events and protect information systems • Perform cyber defense trend analysis and report findings

• Recommend refinement for detection rules to improve accuracy and reduce false positives across SIEM and EDR platforms. • Conduct investigations into security events using tools such as Splunk, Elastic, ArcSight, and XDR platforms (Cisco XDR, Cortex XDR). • Leverage AI to analyze security trends, automate processes, and identify new patterns of threat behavior. • Develop and document detection blueprints to enhance high-fidelity alerting for security threats and compliance risks. • Assist with SOAR platform workflows to improve incident response automation. • Collaborate with internal teams to address gaps in detection visibility and implement best practice mitigations. • Provide mentorship and knowledge sharing to analysts at Level I.

• Lead and support end-to-end compliance efforts across multiple environments, including readiness assessments, audits, and continuous monitoring activities • Leading PCI DSS compliance-related activities and certification • Supporting U.S. Federal readiness efforts, including gap assessments against NIST SP 800-53 • Maintaining required evidence artifacts and ensuring traceability of evidence • Interpreting and operationalizing compliance requirements into actionable control activities for engineering and operations • Serving as SME for PCI DSS and NIST 800-53 compliance • Supporting development of FedRAMP artifacts • Partnering with control owners to ensure controls meet PCI DSS and NIST 800-53 requirements • Supporting external audits by preparing evidence and responding to auditor requests • Driving coordination with third parties to ensure shared control alignment • Ensuring audit readiness through continuous proactive gap assessments and control testing throughout the year • Identifying, assessing, and communicating compliance and security risks to stakeholders • Identifying, tracking, and driving closure of audit findings and control deficiencies • Contributing to the development and maintenance of security policies, standards, and procedures