Senior Analyst, IT Corporate Audit - Cybersecurity

CVS Health•Cumberland, RI

1d•$79,310 - $158,620

About The Position

The Cybersecurity Senior Analyst is a key member of the Internal Audit team, responsible for executing cybersecurity audits and control assessments across the organization’s technology environment. The role performs detailed testing of security controls and information systems to evaluate the design and operating effectiveness of cybersecurity defenses and support assessment of the organization’s control framework. The Senior Analyst independently executes testing and owns assigned audit areas end-to-end, including walkthroughs, evidence collection, validation, and workpaper documentation. Audit coverage includes cloud security (Azure and GCP), network security, data protection, application security, and third-party/vendor risk management. The role identifies control gaps, documents exceptions, and contributes to audit findings and recommendations, applying risk-based thinking and considering mitigating and compensating controls. The position collaborates with Audit Managers, audit colleagues, and IT, compliance, and business stakeholders to obtain evidence, validate remediation, and complete deliverables. It also uses data analytics and emerging technologies, such as AI tools, to improve audit testing and contributes to the ongoing improvement of audit methodologies, tools, and approaches. The Senior Analyst communicates audit results and risks, maintains clear and defensible documentation, stays current on cybersecurity risks and techniques, and supports knowledge sharing and training within Internal Audit.

Requirements

At least 3 years of experience in information security, risk, or compliance, with a focus on cybersecurity controls.
At least one relevant cybersecurity certification, such as CISSP, CISM, or equivalent.
Bachelor’s degree in Information Technology, Cybersecurity, or a related field preferred, or equivalent experience (high school diploma plus 4 years of relevant experience).

Nice To Haves

Experience in a large, complex environment such as healthcare, insurance, or retail.
Demonstrated ability to independently execute moderately complex audit or control testing areas.
Working knowledge of regulatory and industry frameworks such as HIPAA, ISO, PCI DSS, NY DFS, NAIC, SOX, and HITRUST.
Familiarity with cybersecurity domains such as cloud security, vulnerability management, ransomware, and security testing tools.
Ability to collaborate across teams and build strong stakeholder relationships.
Strong analytical, problem-solving, and critical thinking skills.
Effective written and verbal communication skills.
Bachelor’s degree in Information Technology, Cybersecurity, or a related field.

Responsibilities

Independently execute cybersecurity audit testing, including detailed test procedures, evaluations of control design and operating effectiveness, and documentation in accordance with audit standards and methodology.
Own assigned audit areas end-to-end, including walkthroughs, evidence collection, validation, and workpaper documentation.
Test cybersecurity domains including cloud security (Azure and GCP), network security, data protection, application security, and third-party/vendor risk management.
Identify control gaps, document exceptions, and contribute to audit findings and recommendations.
Apply risk-based thinking when evaluating issues, including consideration of mitigating and compensating controls.
Collaborate with Audit Managers and team members to validate control effectiveness and complete deliverables on time.
Partner with IT, compliance, and business stakeholders to understand processes, obtain evidence, and validate remediation activities.
Build and maintain effective working relationships across technology teams.
Use data analytics and emerging technologies, including AI tools, to enhance audit testing, coverage, and efficiency.
Contribute to continuous improvement of audit methodologies, tools, and testing approaches.
Develop clear, concise, and well-supported workpapers and documentation.
Communicate audit results, issues, and risks to audit team members and management.
Stay current on cybersecurity risks, trends, tools, and techniques and apply insights to audit testing and risk identification.
Support knowledge sharing and training efforts within Internal Audit.