Manager, Infrastructure Governance

Cardinal Health

11d•$125,300 - $178,900

About The Position

Infrastructure Governance is part of Information Technology, which oversees the development, delivery, and operation of computing and information services, and delivers IT solutions and strategies that enable operations and drive business value. The function enforces Cardinal Health’s risk and security policies to maintain a secure infrastructure environment and ensure compliance with internal and external regulations. The Manager, Infrastructure Governance leads and mentors Cloud Engineers and advances the team’s governance scope beyond Cloud Security Posture Management (CSPM) and firewall rule monitoring to broader security policy enforcement, vulnerability, data, and application security management. The role promotes automation and AI to provide real-time compliance results, reduce manual verification, and accelerate cloud-risk remediation. The manager governs firewall policies and certifications; oversees cloud security monitoring, alerting, and audit reporting across GCP, Azure, and AWS; and coordinates remediation of non-compliant issues using ServiceNow and GRC platforms. The role also manages SOX server certifications, monitors compliance with information security policies and exception-management standards, develops governance metrics and reports, supports regulatory audits and certifications, and coordinates security onboarding for acquired entities. It aligns governance work with Cyber Operations initiatives, including Unified Vulnerability Management (UVM). This level manages department operations and supervises professional employees, front-line supervisors, and/or business support staff. It participates in developing policies and procedures, ensures employees operate within guidelines, interacts with stakeholders at various management levels, resolves operational or project issues, and gains consensus among involved parties. A bachelor’s degree in a related field or equivalent work experience is preferred.

Requirements

Four to six years of progressive experience in security compliance governance, cloud security engineering, or an equivalent technical risk management role is preferred.
Demonstrated experience leading, mentoring, or technically directing engineering professionals.
Extensive hands-on knowledge of Google Cloud Platform (GCP), Microsoft Azure, and Amazon Web Services (AWS).
Working knowledge of security frameworks, particularly the NIST Cybersecurity Framework (NIST CSF).
Solid understanding of industry regulations and compliance standards, including HIPAA, HITRUST, SOX, and GDPR.
Experience using and integrating GRC platforms, ServiceNow, and cloud-native security tools.
Bachelor’s degree in a related field or equivalent work experience is preferred.

Nice To Haves

Experience with cloud security tools such as Prisma, Wiz, Sentinel, or cloud-native CSPMs.

Responsibilities

Lead and mentor Cloud Engineers, fostering professional growth and a culture of proactive exposure management.
Expand governance beyond CSPM and firewall rule monitoring into security policy enforcement, vulnerability, data, and application security management.
Promote automation and AI to deliver real-time compliance results, reduce manual verification cycles, and accelerate cloud-risk auto-remediation.
Govern firewall rule policies to ensure alignment with network standards and direct the rule certification program for in-scope firewalls.
Oversee CSPM and cloud-native security solutions, including continuous alerting, monitoring, and audit reporting across GCP, Azure, and AWS.
Coordinate remediation campaigns for non-compliant issues using ServiceNow and GRC platforms to assign, track, and verify resolution by solution owners.
Manage SOX server quarterly certifications and address findings promptly.
Analyze and address non-compliance, including deprecated network protocols, least-privilege violations, and configurations that drift from Information Security policies.
Maintain accountability for approved exceptions and ensure their timely remediation, renewal, or closure in accordance with exception-management policies and standards.
Develop governance metrics and provide monthly KPI and KRI reports for internal operations and quarterly Reports of Compliance (ROC) for executive leadership.
Support regulatory audits by serving as a stakeholder and evidence provider for FDA audits and HITRUST certifications and reporting.
Coordinate security onboarding for mergers and acquisitions, integrating acquired entities onto Infrastructure Governance platforms in collaboration with Enterprise Technology Platform and InfoSec Operations teams.
Align governance activities with Cyber Operations strategies and support foundational programs such as Unified Vulnerability Management (UVM).
Manage department operations, supervise professional employees and/or support staff, participate in policy and procedure development, and ensure employees operate within guidelines.
Resolve operational and project issues with stakeholders at various management levels and gain consensus among involved parties.