Senior Analyst – Security Risk Management

This is a fully remote position, open to applicants in North Carolina.

📋 Description

• Create reports, assess vendor evaluation outcomes, and identify and document control deficiencies.

• Analyze and interpret the findings from vulnerability assessments and penetration testing.

• Conduct and assist in risk assessments, including risk metrics and visualization, while identifying and prioritizing risks based on their potential impact and likelihood.

• Engage in information security assessments to ensure adherence to relevant regulatory standards, including PCI, SOX, PII, and PHI.

• Collaborate with key business leaders to facilitate information risk analysis, establish acceptable risk levels, and support risk management processes.

• Liaise with auditors and regulators during compliance and regulatory evaluations to help mitigate risks and audit findings.

• Work alongside colleagues to ensure operational excellence and contribute to the development of policies and standards, as well as security awareness and training.

• Implement the Third-Party Security (TPS) program and act as a primary contact for enterprise participants.

• Ensure thorough security due diligence is conducted for third parties with access to CVS data and/or the CVS environment.

• Identify, evaluate, document, and communicate information security risks.

• Collaborate with business and security stakeholders to facilitate effective risk management and remediation efforts.

⛳️ Requirements

• Minimum of 2 years of experience in an IT Security/IT Risk setting within a large regulated organization.

• Familiarity with risk assessment methodologies, IT/IS Policies and Standards, IT risk standards, and industry best practices (ISO 27001, HITRUST, etc.).

• Previous experience conducting cybersecurity risk assessments in Healthcare or other highly regulated environments.

• One or more of the following certifications: CISSP, CISA, CIPP, CISM, PCIP, ISA, CTPRA.

• Knowledge of regulatory requirements, including Sarbanes-Oxley, HIPAA, and PCI-DSS.

• Understanding and practical experience with Information Security frameworks, including ISO 27001 and the NIST CSF.

• Excellent interpersonal and oral/written communication skills, capable of building relationships at all organizational levels.

• Familiarity with web application security testing and vulnerability testing tools.

• Knowledge of network-level penetration testing.

• Experience in source code reviews utilizing automated tools.

• Bachelor’s degree in Information/Cyber Security or a related field, or equivalent experience (High School diploma + 4 years of relevant experience).

🏝️ Benefits

• Medical coverage.

• Dental coverage.

• Vision coverage.

• Paid time off.

• Retirement savings options.

• Wellness programs.

• Additional resources supporting physical, emotional, and financial well-being.

• CVS Health bonus, commission, or short-term incentive program in addition to base pay.