Bring your heart to CVS Health. Every one of us at CVS Health shares a single, clear purpose: Bringing our heart to every moment of your health. This purpose guides our commitment to deliver enhanced human-centric health care for a rapidly changing world. Anchored in our brand - with heart at its center - our purpose sends a personal message that how we deliver our services is just as important as what we deliver.

Our Heart At Work Behaviors™ support this purpose. We want everyone who works at CVS Health to feel empowered by the role they play in transforming our culture and accelerating our ability to innovate and deliver solutions to make health care more personal, convenient and affordable.

Position Summary

We are looking for a talented and Security Risk Manager to join our Third Party Security team ensuring the security and integrity of CVS Health third parties with access to our data.

• Develop reports and evaluate the results of the vendor assessment
• Identify and document control gaps
• Review and interrupt results of vulnerability assessments and penetration testing
• Communicate with auditors and regulators during compliance and regulatory reviews
• Participate in information security assessments ensuring technical compliance with security related regulatory requirements (PCI, SOX, PII, PHI, etc)
• Collaboratively work with peers to ensure operational excellence
• Contribute to or help lead current state risk assessments, continual risk assessments, risk metrics and visualization and integrated operational risk management
• Identify and prioritize risk based on impact and likelihood
• Work directly with key business leaders to facilitate information risk analysis and risk management processes, identify acceptable levels of risk, and establish roles and responsibilities with regards to information risk management
• Assist in Policy/Standard development and security awareness and training
• Ensure security programs are in compliance with applicable laws, regulations and policies to minimize risk and audit findings

• 5+ years of experience in an IT Security/IT Risk environment with a large regulated organization
• 5+ years of risk assessment methodologies, IT/IS Policies and Standards, IT risk standards and industry best practices (ISO 27000, HITRUST, CoBIT, Managing Vendor Assessments).
• 3+ years of experience of managing vendor assessments.
• 3+ years of experience in development and administration of risk assessments and reviews
• 3+ years of experience in cyber security assessment processes and disciplines
• 3+ years of experience in more than one major IT discipline (distributed computing, networks, application design and development, IT security and business recovery)

• Previous cyber security risk assessment within Healthcare, or other highly regulated environment with CISSP, CISA, CIPP, CISM, PCIP, ISA, CTPRA
• Experience with regulatory requirements, including HIPAA, PCI-DSS, etc
• Knowledge and working experience with Information Security frameworks, including ISO27001 and the NIST CSF
• Cloud, AI and/or other IT/IS background a plus
• Strong interpersonal and oral/written communication skills, able to build relationships at all levels
• Knowledge of IT risk standards and industry best practice approaches such as ISO 27001, HITRUST, etc
• Knowledge of web application security testing and vulnerability testing tools.
• Knowledge of network-level penetration testing
• Knowledge of source code reviews using automated tools such as Veracode and/or manual analysis

• Bachelor's degree or equivalent experience (HS diploma + 4 years relevant experience)