Assistant Vice President (AVP) Security Risk Management

Position Summary 

The AVP Security Risk Management is responsible for reducing enterprise cybersecurity and technology risk by identifying, measuring, prioritizing, and driving treatment of material cyber and technology risks across enterprise technology environments, business processes, third-party relationships, supply chain dependencies, and merger, acquisition, and divestiture activity. 

This leader defines the cyber and technology risk strategy, governance, assessment methods, control validation, and operating routines used to evaluate control effectiveness, threat exposure, technology, data, identity, resilience, third-party, and regulatory risk across internal and external stakeholders. 

Reporting to the Deputy CISO, this collaborative leader partners with senior security, privacy, risk, legal, technology, procurement, corporate development, integration, and business leaders. The AVP converts internal and external cybersecurity and technology risk intelligence—including enterprise control gaps, technology control deficiencies, emerging threats, third-party exposure, supply chain dependencies, and M&A risk—into measurable risk decisions, remediation priorities, control requirements, and executive reporting that help protect CVS Health’s members, colleagues, protected health information, confidential data, critical systems, operations, and brand. 

Key Responsibilities: 

• Evolve CVS Health’s cybersecurity and technology risk management program as a core component of the enterprise cyber and technology risk strategy, including risk taxonomy, risk appetite alignment, assessment methodology, internal and external risk identification, inherent and residual risk scoring, technology and security control validation, governance routines, issue management, and executive risk reporting. 

• Lead the end-to-end lifecycle of third-party cybersecurity risk assessments — including pre-contract due diligence, security architecture review, onboarding, periodic reassessment, continuous monitoring, offboarding, and risk acceptance — across thousands of vendors and business associates, ensuring decisions are transparent, evidence-based, and aligned to enterprise risk appetite. 

• Integrate internal enterprise risk signals and external third-party, supply chain, and M&A cyber and technology risk signals into CVS Health’s enterprise risk posture by identifying systemic exposure, technology concentration risk, control gaps, ransomware exposure, data protection risk, identity and access risk, cloud and infrastructure risk, application and platform risk, software supply chain risk, technology resilience risk, and emerging threat trends. 

• Lead M&A Security onboarding activities by partnering with Corporate Development, Integration Management, Legal, Privacy, Technology, and cybersecurity teams to assess cyber risk during due diligence; evaluate security architecture, identity, data, endpoint, network, vulnerability, cloud, and third-party exposures; define integration security requirements; prioritize remediation; and support secure onboarding of acquired entities, assets, applications, users, suppliers, and data into CVS Health’s security control environment. 

• Lead M&A Security offboarding activities for divestitures, separations, and transition services by defining cybersecurity exit requirements; coordinating secure separation of data, identities, privileged access, applications, infrastructure, network connectivity, endpoints, logging, monitoring, and vendors; validating control ownership; and ensuring cyber risk, regulatory, contractual, and transition service obligations are addressed through transaction close and transition exit. 

• Partner with Security Architecture, Security Operations, Vulnerability Management, Identity and Access Management, Cloud Security, Data Protection, Technology, Privacy, Legal, Enterprise Risk, Procurement, Corporate Development, Integration Management, and business leaders to embed cybersecurity and technology control requirements into sourcing, contracting, vendor governance, acquisition integration, divestiture planning, technology delivery, and operational risk decisions. 

• Serve as a trusted cybersecurity risk advisor to internal stakeholders and external parties — including vendors, suppliers, acquired or divested entities, industry peer groups, regulators, and client due diligence teams — building relationships that strengthen cyber risk decision-making and drive shared accountability for control effectiveness and risk remediation. 

• Collaborate closely with the CISO, DCISO and Chief Privacy Officer (CPO) on cybersecurity and technology risk strategy, regulatory readiness, cyber and technology control posture, material risk escalation, and governance of third-party, supply chain, M&A, and enterprise cyber and technology risk issues. 

• Establish and report cybersecurity and technology key risk indicators, key performance indicators, metrics, trends, and material risk themes that provide senior leadership with clear visibility into internal and external inherent risk, residual risk, control maturity, remediation progress, high-risk vendors, technology control issues, transaction-related cyber and technology exposures, and contribution to overall enterprise risk posture. 

• Drive cybersecurity and technology risk treatment, remediation governance, issue management, compensating controls, exception management, and risk acceptance for both internal control gaps and external exposures, working with vendors, business owners, technology owners, transaction teams, integration teams, vendor relationship managers, and enterprise risk stakeholders to escalate high-risk findings and material exposures through closure. 

• Evaluate and implement cybersecurity risk management tools, GRC capabilities, security ratings services, continuous monitoring platforms, control assessment automation, and data analytics that improve scalability, evidence quality, remediation tracking, and enterprise-level visibility into cyber risk trends and control effectiveness. 

• Represent CVS Health in regulatory examinations, client due diligence reviews, transaction-related reviews, and audits related to cybersecurity risk management, third-party security oversight, supply chain security, M&A security, and cyber control governance. 

• Stay current on emerging cyber threats, adversary tactics, regulatory expectations, healthcare cyber risk trends, ransomware risk, cloud and identity risk, software supply chain risk, AI/ML vendor risk, and transaction-related cyber risk domains, adapting the program to strengthen enterprise resilience. 

• Lead and develop a high-performing cybersecurity risk management team through collaborative, inclusive leadership — fostering accountability, technical depth, business partnership, risk discipline, continuous improvement, and bench strength across the team. 

 
Required Qualifications 

• 10+ years of progressive experience in information security, cybersecurity risk management, technology risk, or IT audit, including 5+ years focused on third-party, vendor, supplier, supply chain, or M&A cyber risk management. 

• Demonstrated experience designing, operating, and maturing cybersecurity and technology risk management programs across a large, complex enterprise, including internal and external risk assessment methodology, inherent and residual risk scoring, technology and security control validation, issue management, risk acceptance, and executive reporting. 

• Experience evaluating cybersecurity and technology control domains such as identity and access management, privileged access, vulnerability management, endpoint security, cloud security, network security, logging and monitoring, data protection, incident response readiness, application security, infrastructure, platform, change management, business continuity, and disaster recovery. 

• Experience supporting merger, acquisition, divestiture, separation, or transition services activities from a cybersecurity risk perspective, including cyber due diligence, security integration planning, control gap remediation, secure onboarding, and secure offboarding requirements. 

• 3+ years of people leadership experience, including building, leading, and managing high-performing teams of security or risk professionals through collaborative, inclusive leadership. 

• Strong leadership and collaboration skills, with a demonstrated ability to build and manage key internal and external collaborative relationships across a matrixed enterprise. 

• Strong working knowledge of cybersecurity and privacy frameworks and regulations relevant to healthcare and insurance, including HIPAA, NIST CSF, NIST 800-53, ISO 27001, HITRUST, SOC 2, PCI DSS, and other applicable regulatory or contractual requirements. 

• Experience with third-party risk management (TPRM), governance, risk, and compliance (GRC) platforms, security ratings services, continuous monitoring capabilities, technology risk reporting, and cyber risk reporting tools. 

• Proven ability to influence senior stakeholders and lead cross-functional partnerships with internal groups — including the CISO, Deputy CISO, CPO, Security Architecture, Security Operations, Identity and Access Management, Vulnerability Management, Cloud Security, Data Protection, Enterprise Third-Party Vendor Management, Procurement, Legal, Privacy, Enterprise Risk, Technology, Corporate Development, Integration Management, and business units — as well as external partners such as vendors, suppliers, transaction partners, and industry peers, to drive risk-informed cybersecurity decisions. 

• Excellent written and verbal communication skills, including the ability to translate complex internal and external cybersecurity and technology risk, threat exposure, control effectiveness, technology control issues, and remediation matters into clear, business-relevant insights for executive leadership, governance committees, regulators, clients, and Board-level audiences. 

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, Business, or related field, or equivalent professional experience 

Preferred Qualifications 

• Relevant industry certifications such as CISSP, CISM, CRISC, CTPRP, CCSP, CISA, or HCISPP. 

• Experience in healthcare, health insurance, pharmacy, or retail industries with large, complex vendor ecosystems and regulated data environments. 

• Master's degree or Juris Doctor with relevant cybersecurity, technology risk, privacy, or regulatory experience. 

• Familiarity with cyber and technology risk quantification, control maturity models, threat-informed risk assessment, continuous control monitoring, technology resilience, cloud security posture, fourth-party risk, AI/ML vendor risk, software supply chain risk, enterprise risk aggregation practices, and transaction-related cybersecurity and technology risk management. 

• Experience supporting regulatory examinations, client due diligence reviews, transaction diligence, or audits related to cybersecurity risk management, third-party security oversight, supply chain security, or M&A security activities.