Information Security Officer - Remote

UnitedHealth Group•Eden Prairie, MN

12h•$91,700 - $163,700•Remote

About The Position

The Information Security Officer serves as a subject matter expert for cybersecurity across Optum Serve, ensuring information security needs are implemented promptly in collaboration with Infrastructure and Operations, ESRO, and Optum Serve Information Security. The role aligns security practices with ESRO standards and government frameworks, including NIST SP 800-37, NIST SP 800-53, NIST SP 800-171, and FedRAMP, to obtain and maintain Authorizations to Operate (ATOs), FedRAMP authorizations, and CMMC Level 2 certifications. It manages security controls to safeguard networks and systems and responds to government and client security and compliance inquiries. The position coordinates, develops, updates, and maintains security documentation for CMMC Level 2 certification and ATO packages, including SSPs, contingency plans, configuration management plans, incident response plans, POAMs, and annual updates. It also manages and reports system risks and vulnerabilities, coordinates third-party audits, oversees annual penetration tests, and facilitates discussions to identify security risks and weaknesses for remediation and documentation. This is a remote role that may be performed from anywhere within the United States, with 10% travel. Remote employees must follow UnitedHealth Group’s Telecommuter Policy.

Requirements

Bachelor’s degree in information security, cybersecurity, computer science, or equivalent.
5+ years of information security experience.
3+ years of FISMA-related experience.
3+ years of experience with Assessment and Authorization (A&A) and Independent Verification & Validation (IV&V).
Solid understanding of cloud computing models, management of cloud-based environments, and cloud providers.
Solid understanding of security architecture, operating systems, databases, networks, applications, and security tools.
Solid knowledge and experience with NIST 800-53, NIST 800-171, CMMC, FedRAMP, and the DoD Risk Management Framework.
Solid knowledge and experience implementing or ensuring compliance with Security Technical Implementation Guides (STIGs) and the ATO process, including POAM management.
U.S. citizenship.
Good standing with at least one of the following certifications: CISSP or CISM.
Willingness to travel 10%.
Remote employees must adhere to UnitedHealth Group’s Telecommuter Policy.
If offered the position, provide extensive personal information to obtain and maintain a suitability or eligibility determination for a Confidential/Secret or Top Secret security clearance as a condition of employment.
Pass a drug test before beginning employment.

Responsibilities

Serve as a subject matter expert for information security governance, risk management, and compliance in accordance with the NIST Risk Management Framework.
Liaise with business and IT groups on security compliance, design, planning, implementation, and continuous monitoring for IT and business-related projects.
Create and maintain standard operating procedures and work with multifunctional team members to maintain high-quality work standards.
Manage security controls to safeguard Optum Serve networks and systems, ensuring timely implementation of information security needs in collaboration with relevant teams.
Address government and client inquiries related to security and compliance.
Coordinate, develop, update, and maintain security documentation for CMMC Level 2 certification and ATO packages, including annual updates.
Manage and report system risks and vulnerabilities.
Coordinate third-party audits and oversee annual penetration tests.
Facilitate regular discussions of vulnerabilities and control weaknesses to identify risks in systems and networks and ensure timely remediation and documentation.
Support ATO, FedRAMP authorization, and CMMC Level 2 certification processes, including POAM management.