Director - Cyber Assurance

McKesson•Richmond, VA

4d•$150,000 - $250,000

About The Position

The Director of Cybersecurity Assurance leads cyber assurance and advisory functions for the security organization and manages security leads responsible for cyber risk management, security architecture, regulatory and audit compliance, and policy development. The role provides architecture and advisory support to business and product teams to embed security by design, and owns the cybersecurity awareness program, including tabletop exercises and phishing campaigns. The Director sets strategy, roadmaps, and success metrics; governs delivery and reliability rhythms; and drives security outcomes across teams. The role also secures leadership alignment, defines oversight scorecards, ensures adherence to enterprise policies, and communicates risks and progress to executive leadership. The Director designs and owns the enterprise Cyber Assurance strategy and operating model, builds the team and program roadmap, and leads security architecture, advisory, risk management, remediation, policy, awareness, resilience, asset management, and third-party risk programs. The role partners across security, infrastructure, cloud, application/product, business, audit/compliance, privacy, legal, and HR stakeholders. It also oversees metrics and executive reporting, vulnerability and control-gap remediation, incident response and recovery processes, vendor relationships, and investment roadmaps. McKesson Medical-Surgical (MMS), the business this role supports, is a McKesson Corporation subsidiary and publicly reported segment that distributes medical-surgical supplies, pharmaceuticals, diagnostic equipment and supplies, and related solutions to healthcare providers outside traditional hospitals. MMS has approximately 8,000 employees, 15 distribution centers, approximately 900 delivery vehicles, more than 2,200 manufacturer partners, and over 200,000 customer accounts. The position is classified as Career Level M4. The stated base pay range is $150,000–$250,000; annual bonus or long-term incentive opportunities may also be offered.

Requirements

Typically requires 15 or more years of professional experience and 10 or more years of diversified leadership, planning, communication, organization, and people-motivation skills, or equivalent experience.
15 or more years of cybersecurity experience, including significant depth in security architecture, cyber assurance and advisory, third-party management, cyber GRC, risk management, and compliance.
10 or more years leading teams and/or enterprise programs.
Bachelor’s degree in computer science, information security/assurance, engineering, or a related field, or equivalent experience.
Hands-on and leadership experience managing a security architecture program.
Ability to drive remediation at scale by establishing SLAs, clarifying ownership, prioritizing backlogs, and closing systemic gaps surfaced by incidents, hunts, and assessments.
Executive-ready communication and stakeholder-management skills, including presenting risk, progress, and investment needs to senior leadership and influencing decisions.
Ability to set strategy, secure organizational alignment and approvals, and deliver outcomes through multiple stakeholders across security, infrastructure, cloud, application/product, and business teams.
Deep understanding of cybersecurity risk management, compliance, architecture, and advisory services.
Ability to translate detection gaps and remediation tradeoffs into business impact, present to executives, and drive decisions to closure.
Experience establishing oversight metrics and operational rhythms, such as OKRs/KPIs, reporting, and service reviews, and using data to improve alert quality, reduce noise, and accelerate remediation.
Working knowledge of relevant governance and regulatory expectations, and ability to partner with audit/compliance and privacy stakeholders while operating an effective detection and response capability.
Track record of building high-performing teams and leading with integrity, accountability, and operational discipline; clear communication, sound judgment, and reliable execution.
Experience developing multi-year roadmaps and influencing investment decisions involving people, tooling, telemetry, and automation.
Experience managing vendor relationships and service contracts for security tooling and managed services, including defining requirements and measuring performance against outcomes.
Strong understanding of privacy considerations and appropriate monitoring practices; ability to partner with Legal/Privacy and HR and ensure monitoring and investigations remain within policy and regulatory boundaries.
Experience operating in hybrid/cloud environments and partnering with platform teams to instrument systems for reliable detection.
Strategic and tactical decision-making skills, including balancing speed and risk, defining compensating controls, and driving complex remediation decisions across multiple owners.
Trusted leadership that builds credibility through transparency, follow-through, and a culture of operational excellence.

Nice To Haves

An advanced degree or equivalent experience.
Relevant certifications such as CISSP, CISM, GIAC/SANS, Security+, SSCP, or an equivalent foundational security certification.
TDR/SecOps certifications such as Google Cloud Professional Cloud Security Engineer, Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, or relevant GIAC certifications (for example, GSEC or GCIH), depending on role focus.
Cloud/security engineering certifications aligned to the teams’ platforms.
Experience leading or sponsoring purple-team activities, tabletop exercises, and control validation.

Responsibilities

Design and own the enterprise Cyber Assurance strategy and operating model, including building the team and establishing the program’s direction and roadmap.
Lead the cybersecurity architecture practice and build a program that embeds security-by-design practices and requirements.
Provide security advisory services to business and application teams; perform security and threat assessments, identify control gaps, and ensure requirements are incorporated into architecture designs.
Partner with the Threat Detection & Response leader to implement a threat modeling program.
Develop and lead cybersecurity metrics and executive reporting processes, including KPIs.
Establish a remediation program to close vulnerabilities and gaps identified through incidents, assessments, architecture reviews, and vulnerability scans; define ownership, prioritization, timelines, and exception processes.
Lead cybersecurity risk management activities, including audit and regulatory work, and coordinate assessment activities and deliverables with risk partners.
Design and implement policies, standards, and procedures with key stakeholders, including governance, reporting, and exception processes.
Lead and develop the cybersecurity awareness program, including cyber tabletop exercises and phishing campaigns.
Lead the cybersecurity resiliency program and ensure effective incident response and recovery processes.
Develop and implement an asset management program within the cybersecurity organization.
Lead third-party risk management programs and processes, including third-party inventory, risk assessments, prioritization, and risk severity evaluation.
Set strategy, roadmaps, and success metrics; govern delivery and operational rhythms; and drive security outcomes across teams.
Secure leadership alignment, define oversight scorecards, ensure adherence to enterprise policies, and communicate risks and progress to executive leadership.
Manage vendor relationships and service contracts for security tooling and managed services, including requirements and outcome measurement.
Partner with platform teams to instrument hybrid and cloud systems with logging, identity signals, endpoint telemetry, and network data for reliable detection.
Lead or sponsor purple-team activities, tabletop exercises, and control validation to improve detection coverage and response playbooks.