Senior Analyst - Security Risk Management

CVS Health•Carolina, NC

23h

About The Position

The Senior Security Analyst helps protect CVS data by ensuring that identified risks, vulnerabilities, and defects are managed, tracked, and remediated according to policy and industry best practices. The role executes the Third-Party Security (TPS) program and serves as a key contact for enterprise participants who submit vendors to the program. It ensures appropriate security due diligence for third parties with access to CVS data or the CVS environment, applying risk management, IT, and cybersecurity knowledge to identify, assess, document, and communicate information security risks. The analyst also partners with business and security stakeholders to support effective risk management and remediation. This full-time position is scheduled for 40 hours per week. The stated pay range is $64,890 to $129,780, and the position is eligible for a CVS Health bonus, commission, or short-term incentive program. Benefits for eligible colleagues include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources.

Requirements

At least 2 years of experience in an IT Security or IT Risk environment within a large regulated organization.
Knowledge of risk assessment methodologies, IT/IS policies and standards, IT risk standards, and industry best practices such as ISO 27001 and HITRUST.
Bachelor’s degree in Information/Cyber Security or a related field, or equivalent experience (high school diploma plus 4 years of relevant experience).

Nice To Haves

Previous cybersecurity risk assessment experience in healthcare or another highly regulated environment.
One or more of the following certifications: CISSP, CISA, CIPP, CISM, PCIP, ISA, or CTPRA.
Experience with regulatory requirements, including Sarbanes-Oxley, HIPAA, and PCI-DSS.
Knowledge and working experience with information security frameworks, including ISO 27001 and the NIST CSF.
Strong interpersonal and oral and written communication skills, with the ability to build relationships at all levels.
Knowledge of web application security testing and vulnerability testing tools.
Knowledge of network-level penetration testing.
Knowledge of source code reviews using automated tools.

Responsibilities

Develop reports, evaluate vendor assessment results, and identify and document control gaps.
Review and interpret vulnerability assessment and penetration testing results.
Conduct and support risk assessments, including risk metrics and visualization, and prioritize risks based on impact and likelihood.
Participate in information security assessments to ensure compliance with applicable regulatory requirements, including PCI, SOX, PII, and PHI.
Partner with business leaders to facilitate information risk analysis, establish acceptable levels of risk, and support risk management processes.
Communicate with auditors and regulators during compliance and regulatory reviews and help minimize risk and audit findings.
Collaborate with peers to support operational excellence and assist with policy and standard development, security awareness, and training.