Associate Vice President, Platform Security

CVS Health • Work At Home-Arizona, AZ

8d • $185,400 - $375,950

About The Position

CVS Health is seeking an experienced security leader to define and execute the enterprise strategy for securing cloud, container, and AI platforms across its technology estate. The role owns technical security standards, architecture, controls, and the operating model for secure adoption of cloud-native infrastructure, containerized workloads, and enterprise AI and GenAI capabilities. The Associate Vice President will lead teams across Cloud Security, Container Security, and AI Security and partner with technology, infrastructure, application, IAM, Cyber Defense, Data Protection, Legal, Compliance, and business leadership. The role balances risk reduction, engineering velocity, and enterprise adoption by embedding security into platform design, deployment, runtime governance, and ongoing operations.

Responsibilities include setting enterprise platform security strategy and standards; governing cloud and container security architectures and tooling; establishing an AI Security function, operating model, and technical controls; and developing AI gateway, model, and agentic security requirements. The role also oversees security governance, compliance alignment, vulnerability and misconfiguration management, executive risk reporting, and collaboration with internal stakeholders, vendors, and industry groups. It reports directly to the Vice President of Security Engineering and Platforms.

Requirements

• 12 or more years of progressive experience in information security, cybersecurity engineering, cloud security, infrastructure security, platform security, or related technology leadership roles.
• 5 or more years of senior leadership experience building, leading, and scaling cross-functional security engineering teams in large, complex enterprise environments.
• Deep technical expertise in cloud security architecture and operations across major cloud platforms, including posture management, identity and access controls, network segmentation, encryption, logging, vulnerability management, and policy enforcement.
• Strong understanding of container and Kubernetes security, including image scanning, workload protection, runtime controls, secrets management, cluster hardening, CI/CD integration, and vulnerability remediation.
• Demonstrated experience defining technical security standards, reference architectures, control frameworks, and engineering guardrails for enterprise-scale platforms.
• Experience with AI, GenAI, or emerging technology security programs, including AI governance, AI platform security, model risk, agentic systems, prompt and response guardrails, model scanning, AI threat modeling, or AI runtime monitoring.
• Strong knowledge of security posture management, vulnerability management, threat modeling, risk-based prioritization, and executive-level risk reporting.
• Proven ability to influence engineering culture, platform governance, security control adoption, and strategic investment decisions across multiple leadership levels.
• Experience in highly regulated environments and applying security requirements aligned to healthcare, privacy, financial, or critical infrastructure obligations.
• Excellent communication and presentation skills, including the ability to translate complex security risks into clear executive decisions and narratives.

Nice To Haves

• Advanced degree in Computer Science, Information Security, Cybersecurity, Engineering, AI/ML, or a related field.
• Certifications such as CISSP, CISM, CCSP, AWS Security Specialty, Azure Security Engineer, Google Professional Cloud Security Engineer, Kubernetes Security Specialist, or equivalent.
• Experience establishing or scaling an AI Security function, AI governance control model, AI gateway strategy, model security program, agentic security capability, or AI red teaming function.
• Familiarity with ISO/IEC 42001, NIST AI RMF, MITRE ATLAS, OWASP Top 10 for LLM Applications, OWASP Agentic guidance, NIST CSF, and cloud security best-practice frameworks.
• Experience with CNAPP, CSPM, CWPP, container security, API gateway, model gateway, AI guardrail, SSPM/AISPM, and security data platform technologies.
• Experience in healthcare, pharmacy, insurance, financial services, or another highly regulated industry.
• Demonstrated success partnering with cloud and AI platform providers, enterprise architecture, procurement, third-party risk, privacy, legal, compliance, and business technology leaders.

Responsibilities

• Define and own the enterprise platform security strategy, roadmap, and policy framework for cloud, container, and AI security.
• Establish unified technical standards and architecture across cloud, container, and AI platforms.
• Stand up and mature the AI Security operating model as an enterprise capability.
• Advise senior technology, security, and business executives on platform security risks, emerging threats, and industry practices.
• Drive continuous improvement through risk-based prioritization, KPIs, executive reporting, benchmarking, and innovation.
• Own strategy, architecture, and operational standards for enterprise cloud security, including posture management, policy-as-code, identity and access guardrails, vulnerability reduction, and remediation automation.
• Define and govern container and Kubernetes security across cloud and on-premises platforms, including image scanning, workload protection, runtime controls, configuration standards, and vulnerability management.
• Promote preventive guardrails, policy enforcement, infrastructure-as-code controls, and self-service remediation.
• Influence the platform security tooling portfolio and manage vendor strategy, platform health, roadmap alignment, and capability adoption.
• Establish and scale an AI Security function with accountability for AI governance, platform and model security, agentic security, incident readiness, and risk reporting.
• Define enterprise AI security standards for gateways, guardrails, model review and inventory, AI use-case classification, and high-risk use cases.
• Set security requirements for AI and agent gateways, including identity propagation, tool brokering, prompt-injection defenses, data protection, auditability, traffic controls, and runtime governance.
• Develop controls for agent identity, access, tool governance, long-running activity, non-human identities, revocation, kill switches, human oversight, and runtime monitoring.
• Lead security architecture for AI models and platforms, including scanning, provenance, unauthorized model detection, visibility, adversarial testing, and red teaming.
• Partner with Cyber Defense on AI monitoring, detection, incident response playbooks, audit logging, and operational telemetry.
• Define and maintain platform security policies, standards, reference architectures, and procedures for cloud, container, infrastructure, and AI security.
• Align security controls with applicable regulatory frameworks and industry standards.
• Provide executive governance dashboards on program health, control coverage, security posture, remediation, residual risk, and leadership decisions.
• Establish risk-based vulnerability and misconfiguration management processes with ownership, remediation SLAs, escalation paths, and executive transparency.
• Partner with Legal, Compliance, Privacy, TPRM, Data Protection, and AI Governance teams to assess AI tools, connectors, platforms, SaaS services, and third-party capabilities before production use.
• Build, lead, and develop cloud, container, infrastructure, and AI security teams and distinguished engineering leaders.
• Lead through direct and matrixed influence across security, infrastructure, application, IAM, cyber, data protection, developer experience, architecture, and business technology teams.
• Align platform security priorities with broader security engineering strategy, OKRs, investment decisions, and delivery commitments.
• Engage cloud providers, security vendors, AI platform providers, and industry standards groups to inform architecture and roadmaps.
• Foster secure-by-default platform engineering, risk-based decision-making, operational accountability, automation, and business enablement.
• Deliver platform security outcomes measured by posture improvement, coverage, remediation SLAs, AI security maturity and adoption, inventory visibility, reduction in unauthorized AI use, compliance readiness, executive risk transparency, and roadmap delivery.

Benefits

• Medical coverage
• Dental coverage
• Vision coverage
• Paid time off
• Retirement savings options
• Wellness programs
• Other resources supporting physical, emotional, and financial well-being, based on eligibility
• CVS Health bonus, commission, or short-term incentive program eligibility
• Equity award program target

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed