Senior Analyst, IT Compliance & Risk - Data Protection

CVS Health•Woonsocket, RI

7d•$79,310 - $173,040•Hybrid

About The Position

The Corporate Functions & PCW IT Compliance Team is seeking a Data Protection Domain subject matter expert focused on information classification, data obfuscation, encryption, and data security controls and governance. This role will help build, maintain, and continuously improve the support framework for Data Protection. It will contribute to day-to-day operations, manage compliance workload and emerging priorities, and provide front-line support to application teams to help ensure compliance with data privacy and protection policies, industry regulations, and contractual obligations. The position is hybrid in Woonsocket, Rhode Island, or Wellesley, Massachusetts, highly preferred; remote work will also be considered. The role is full-time, with 40 anticipated weekly hours.

Requirements

Strong knowledge of data protection techniques and best practices, including data obfuscation or masking, sensitive information classification, encryption at rest and in transit, and data retention and destruction.
At least 3 years of experience implementing data security and privacy engineering solutions and frameworks.
Knowledge of IT security-related regulations and frameworks such as PCI, HIPAA, SOX, SOC1, SOC2, HiTrust, GDPR, CCPA, NIST, and ISO 27001.
Strong problem-solving, analytical, critical-thinking, and organizational skills, including versatility in handling concurrent high-priority tasks.
Strong oral and written communication skills, with the ability to explain complex problems and solutions clearly and effectively to technical and non-technical stakeholders.
Self-motivation and the ability to work independently with minimal supervision or direction and prioritize work effectively.
Ability to handle concurrent high-priority tasks and work in a dynamic environment.
Comfort working with ambiguity and iterating consistently to make progress.
Experience on technical projects involving multiple teams, providing management with status updates on potential issues, and driving issues to resolution.
Intermediate to advanced proficiency in MS Excel, including pivot tables, lookups, conditional formatting, and Power Query.
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent work experience (high school diploma plus 3 years of relevant experience).

Nice To Haves

Security certifications such as CISSP, CRISC, CISA, CISM, or CCSP.
Product Management and Program Management experience.
Exposure to process improvement, Lean, or Six Sigma.
Ongoing education in cybersecurity, data privacy and protection, or related domains.

Responsibilities

Develop and implement a data security governance framework aligned with industry best practices, regulatory requirements, and company policies.
Guide and assist application teams in identifying data protection gaps and developing remedial action plans for policy non-conformance.
Assess and interpret IT policies and control standards for system and operational compliance.
Maintain key files and data sources used for compliance governance and reporting, including operational metrics, and ensure data quality, consistency, and integrity.
Assist with compiling and maintaining process documentation, job aids, FAQs, and other support materials for application teams.
Promote data privacy and protection best practices and compliance with applicable regulations and standards, including PCI, SOX, HIPAA, HiTrust, and NIST.
Monitor industry trends, emerging data security and privacy engineering technologies, and security threats to continuously improve data protection strategy and solutions.