The Role
Coordinate enterprise vulnerability remediation from discovery through closure, tracking SLAs, exceptions, evidence, and contractual obligations. Partner with security, application, infrastructure, engineering, compliance, and customer teams to reduce risk and support audits. Develop executive and customer-facing reports, dashboards, metrics, and remediation summaries while maintaining audit-ready documentation. Facilitate governance meetings, escalate overdue findings, assess remediation trends, and translate technical vulnerabilities into business risk.
Summary Generated by Built In
Requisition Number: 2390965
Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.
The Information Security Analyst is responsible for supporting customer and contractual security obligations related to vulnerability management. This role serves as the liaison between security teams, application owners, infrastructure teams, and customer-facing stakeholders to ensure vulnerabilities are tracked, remediated within required service levels, and documented appropriately for internal governance and external customer reporting purposes.
The analyst will coordinate vulnerability remediation activities, monitor compliance with contractual and regulatory requirements, maintain accurate remediation evidence, support customer audits and questionnaires, and develop executive and customer-ready reporting that demonstrates effective management of security risks.
Primary Responsibilities:
Required Qualifications:
Preferred Qualifications:
Success Measures (First Year)
At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone - of every race, gender, sexuality, age, location and income - deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.
Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.
The Information Security Analyst is responsible for supporting customer and contractual security obligations related to vulnerability management. This role serves as the liaison between security teams, application owners, infrastructure teams, and customer-facing stakeholders to ensure vulnerabilities are tracked, remediated within required service levels, and documented appropriately for internal governance and external customer reporting purposes.
The analyst will coordinate vulnerability remediation activities, monitor compliance with contractual and regulatory requirements, maintain accurate remediation evidence, support customer audits and questionnaires, and develop executive and customer-ready reporting that demonstrates effective management of security risks.
Primary Responsibilities:
- Vulnerability Tracking & Governance
- Track identified vulnerabilities from discovery through remediation and closure
- Monitor remediation progress against internal policies, SLAs, customer contractual requirements, and regulatory obligations
- Review vulnerability exception requests and ensure appropriate documentation and approvals are obtained
- Escalate overdue vulnerabilities to appropriate management and stakeholders
- Validate remediation status and supporting evidence prior to closure
- Support remediation governance meetings and maintain action item tracking
- Customer Contractual Compliance
- Interpret customer security requirements related to vulnerability management
- Ensure remediation activities comply with contractual commitments and customer-specific timelines
- Provide customers and internal account teams with vulnerability remediation status updates
- Support customer security reviews, audits, assessments, and questionnaires
- Maintain documentation supporting contractual security obligations
- Coordinate responses to customer requests for remediation evidence and security reporting
- Documentation and Evidence Management
- Maintain detailed remediation records and supporting evidence
- Develop remediation summaries, executive reports, and customer-facing status reports
- Ensure audit-ready documentation exists for vulnerability findings and corrective actions
- Track historical remediation efforts and maintain records for compliance reviews
- Create and update procedures, standards, and operational documentation
- Reporting & Metrics
- Produce recurring vulnerability management reports and dashboards
- Track SLA performance, aging vulnerabilities, remediation trends, and exceptions
- Develop executive summaries highlighting high-risk findings and remediation status
- Support Key Risk Indicator (KRI) and Key Performance Indicator (KPI) reporting
- Analyze remediation trends and identify opportunities for process improvement
- Cross-Functional Collaboration
- Partner with application, infrastructure, engineering, and operations teams
- Coordinate remediation efforts across multiple business units
- Engage with Security Operations, Vulnerability Management, Risk Management, Compliance, and customer account teams
- Facilitate discussions regarding remediation priorities and risk reduction strategies
- Comply with all applicable Company policies, procedures, and business directives, changes including those relating to work location, team assignments, work schedules, and flexible work arrangements
Required Qualifications:
- Technical Security Knowledge
- Vulnerability management lifecycle
- CVSS scoring and severity assessment
- Common Vulnerabilities and Exposures (CVE)
- Security testing methodologies
- Vulnerability scanning
- DAST
- SAST
- SCA
- Penetration testing
- Patch management processes
- Risk management principles
- Security controls and remediation strategies
- Vulnerability Management Platforms
- Experience with one or more:
- Tenable
- Qualys
- Rapid7
- Microsoft Defender
- Prisma Cloud
- GitHub Advanced Security
- ServiceNow Vulnerability Response
- Other enterprise vulnerability management solutions
- Experience with one or more:
- Documentation & Reporting Skills
- Solid technical writing
- Creation of executive summaries
- Audit evidence collection
- Customer-facing reporting
- Security questionnaire responses
- Process documentation
- Metrics and dashboard development
- Regulatory & Contractual Knowledge
- Working knowledge of:
- HITRUST
- HIPAA
- NIST Cybersecurity Framework
- NIST 800-53
- ISO 27001
- SOC 2
- Customer security contractual requirements
- Third-party risk management practices
- Working knowledge of:
- Analytical Skills
- Root cause analysis
- Trend identification
- Risk assessment
- Data analysis
- SLA tracking
- Prioritization of remediation efforts
- Communication Skills
- Customer-facing communication
- Executive reporting
- Stakeholder management
- Meeting facilitation
- Conflict resolution and escalation management
- Ability to translate technical findings into business risk language
Preferred Qualifications:
- Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
- Certifications include:
- Security+
- CySA+
- CISSP
- CISM
- GSEC
- GIAC Vulnerability Management (if available)
- CRISC
- Experience:
- 3+ years in Information Security, Vulnerability Management, Risk Management, Compliance, or Security Operations
- Experience supporting customer security reviews and audit responses
- Experience working with enterprise vulnerability remediation programs
- Experience developing executive and customer reporting
Success Measures (First Year)
- A successful analyst in this role would:
- Maintain vulnerability remediation compliance with contracted and policy-driven SLAs
- Produce accurate customer remediation reports and audit evidence
- Reduce aging and overdue vulnerabilities through effective tracking and escalation
- Improve visibility into remediation activities through reporting and metrics
- Successfully support customer audits, assessments, and contractual reviews
- Establish reliable documentation processes that withstand internal and external audits
At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone - of every race, gender, sexuality, age, location and income - deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.
Skills Required
- Knowledge of the vulnerability management lifecycle
- Knowledge of CVSS scoring and severity assessment
- Knowledge of Common Vulnerabilities and Exposures (CVE)
- Knowledge of security testing methodologies
- Experience with vulnerability scanning
- Knowledge of DAST, SAST, and SCA
- Knowledge of penetration testing
- Knowledge of patch management processes
- Knowledge of risk management principles, security controls, and remediation strategies
- Experience with an enterprise vulnerability management platform such as Tenable, Qualys, Rapid7, Microsoft Defender, Prisma Cloud, GitHub Advanced Security, or ServiceNow Vulnerability Response
- Technical writing and process documentation skills
- Experience creating executive summaries and customer-facing security reports
- Experience collecting audit evidence and responding to security questionnaires
- Experience developing metrics and dashboards
- Working knowledge of HITRUST, HIPAA, NIST Cybersecurity Framework, NIST 800-53, ISO 27001, and SOC 2
- Knowledge of customer security contractual requirements and third-party risk management
- Root cause analysis, trend identification, risk assessment, data analysis, SLA tracking, and remediation prioritization skills
- Customer-facing communication, executive reporting, stakeholder management, meeting facilitation, conflict resolution, and escalation management skills
- Ability to translate technical findings into business risk language
- Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Systems, or a related field
- Security+, CySA+, CISSP, CISM, GSEC, GIAC Vulnerability Management, or CRISC certification
- 3 or more years of experience in information security, vulnerability management, risk management, compliance, or security operations
- Experience supporting customer security reviews and audit responses
- Experience with enterprise vulnerability remediation programs
- Experience developing executive and customer reporting
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Optum, part of the UnitedHealth Group family of businesses, is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together. At Optum, we support your well-being with an understanding team, extensive benefits and rewarding opportunities. By joining us, you’ll have the resources to drive system transformation while we help you take care of your future. We recognize the power of connection to drive change, improve efficiency and make a difference in health care. Join a team where your skills and ideas can make an impact and where collaboration is key to creating technology that produces healthier outcomes.
Gallery
.jpg)
Optum Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Optum has three workplace models that balance the needs of the business and the responsibilities of each role. These models, core on‑site (5 days/week), hybrid (4 days/week) and telecommute or fully remote, vary by country, role and location.
Typical time on-site:
Not Specified
