Assistant Vice President, Technology Assurance

CVS Health•Hartford, IL

6d•$185,400 - $375,950•Hybrid

About The Position

The Assistant Vice President (AVP), Technology Assurance leads Internal Audit’s technology audit and assurance coverage across CVS Health. This role integrates three key areas: established technology and cybersecurity audit, emerging risk assurance, and Internal Audit's advisory role in major enterprise system implementations. The AVP provides independent, third-line assurance and advisory support for the technology landscape. While technology risk ownership, strategy, and deployment decisions rest with technology, digital, and business leadership, this role independently evaluates and advises on them. Consistent with the Emerging Risk Assurance function, the AVP adds value early and identifies gaps without taking management responsibility, thereby preserving independence. The AVP establishes direction and quality standards for their teams and represents Internal Audit with senior technology, digital, and business leaders on cross-cutting issues. By overseeing both established IT/cybersecurity audit and emerging risk assurance, the AVP ensures direct coordination between these pillars for complete and efficient coverage. Additionally, the AVP acts as Internal Audit’s embedded advisor for large-scale ERP implementations, identifying control and risk considerations for program leadership before go-live, separate from any formal testing.

Requirements

15+ years of progressive experience in internal audit, risk, compliance, or related fields, including team leadership
Experience leading through Director-level people managers who own their respective functional areas, operating in complex, ambiguous, multi-functional environments
Ability to influence and partner across functions at the executive level
Strong project and program management skills, with the ability to manage multiple priorities and meet deadlines
Exceptional communication and executive presentation skills
Experience with audit committee and senior leadership reporting
Strategic mindset with the ability to develop and execute enterprise-wide initiatives
Team leadership skills
Proficiency in audit tools, data analytics, and Microsoft Office suite
Bachelor's degree (required)

Nice To Haves

Comfort operating at the intersection of established IT controls and emerging AI risk is essential, since this role is the point where those two audit disciplines meet.

Responsibilities

Set strategy and audit plan coverage for IT corporate audit and cybersecurity, aligned to enterprise risk appetite.
Oversee the Executive Director, DDAT/IT Audit in execution of the IT and cyber audit plan, including cybersecurity controls, incident response, and regulatory compliance reviews.
Hold the primary Internal Audit relationship with technology leadership, providing independent perspective on control effectiveness, IT governance, and risk management maturity.
Report technology audit results, themes, and emerging risks to the CAE and Audit Committee.
Oversee the Executive Director, Emerging Risk Assurance and the third-line assurance function over AI, machine learning, intelligent automation, and other algorithmic or autonomous decision-making risk.
Ensure emerging risk assurance work stays positioned as independent evaluation of governance and controls, distinct from strategy-setting or management of how AI and emerging solutions are built and deployed.
Coordinate emerging risk coverage against established technology audit coverage owned by the DDAT/IT Audit team, so the two pillars stay aligned without duplicating work.
Maintain the human-in-the-loop versus human-over-the-loop distinction across audit approach and reporting, including for AI-related changes to the SOX control environment.
Support the Emerging Risk Assurance team's advisory role with the AI Governance Council and technology teams during design of new AI use cases and governance structures.
Serve as Internal Audit's embedded advisory presence on governance and steering forums for large-scale ERP implementations.
Surface control and risk considerations to program leadership ahead of go-live in an advisory capacity.
Define the boundary between this advisory role and any downstream formal audit or SOX testing the program later requires.
Keep the CAE informed on ERP program risk and readiness at key milestones.
Lead, develop, and hold accountable the leaders of both functions and their teams, building a high-performance culture across established and emerging technology audit disciplines.
Build bench strength and succession depth across the technology assurance pillar.
Communicate audit results clearly and credibly to both technical and non-technical stakeholders, translating complex technology risk into actionable business insight.
Build trusted working relationships with technology leadership, the AI Governance Council, ERP program leadership, and business partners while preserving audit independence.
Model Internal Audit's leadership standards: communicate openly, act with integrity, and win together.