Senior Manager - Cybersecurity Compliance

CVS Health•Cumberland, RI

1d•$106,605 - $284,280

About The Position

The Senior Manager of Cybersecurity Compliance leads and executes strategic regulatory compliance initiatives for CVS Health’s Enterprise Information Security team. The role guides colleagues in facilitating regulatory assessments and enterprise-wide compliance activities, and develops, implements, and manages procedures, controls, and reporting to ensure compliance with regulations. It consults on improvements to internal controls, processes, and systems to strengthen program effectiveness and efficiency, and partners with IT and business colleagues to educate them on risk and provide actionable control-effectiveness metrics. The position coordinates process owners’ activities in support of regulatory audits, including responding to audit requests and tracking remediation. It also collaborates with senior management, Legal, Internal Audit, and external assessors to align and support the Regulatory Compliance Program. The role manages cybersecurity regulatory audits and compliance activities, establishes schedules and plans, develops processes for regulatory, internal audit, and industry-standard assessments, and coaches stakeholders on compliance requirements and best practices. It defines risk-management policies and procedures for enterprise technology controls, oversees compliance reporting and security-control assessments, and educates stakeholders on risk-management frameworks and regulatory compliance risks.

Requirements

At least 7 years of experience in information technology or information security, with a deep understanding of regulations and their requirements and implications for cybersecurity controls.
At least 3 years of experience working with auditors and/or assessors, formulating responses, managing inquiries, and designing or overseeing remediation plans.
At least 3 years of experience with relevant regulations, standards, and frameworks, including FTC, HIPAA, NY DFS, SOX, PCI, NIST, ISO, HITRUST, and NAIC.
At least 3 years of experience with audit methodologies, internal-control frameworks, risk assessments, and control-testing techniques.
Relevant professional certification such as CRISC, CISA, or CISSP.
Bachelor’s degree or equivalent experience; alternatively, a high school diploma and 4 years of relevant experience.
Strong written and verbal communication skills, including the ability to explain complex concepts clearly and concisely.
Strong analytical and problem-solving skills, including the ability to interpret regulations, operational data, and trends, assess risk, and recommend improvements.
Interpersonal skills to collaborate across departments and influence stakeholders at all levels.
Attention to detail and accuracy when conducting assessments, documenting processes, and reviewing controls.
Program-management skills, including strategic planning, decision-making, and project management.
Ability to collaborate with cross-functional teams, build stakeholder relationships, and influence others to achieve compliance objectives.

Nice To Haves

Experience in a large, complex healthcare, insurance, or retail environment.
Knowledge of and hands-on experience with federal and state healthcare regulations, regulatory frameworks, examinations, audits, and compliance assessments, including applying requirements in a complex healthcare environment.
Experience designing, implementing, and managing Regulatory Change Management programs, including identifying, assessing, communicating, and integrating regulatory changes into business processes, policies, controls, and compliance frameworks.
Experience managing work efforts with internal and external partners in a highly collaborative environment.

Responsibilities

Manage and execute procedures supporting cybersecurity regulatory audits and compliance activities; establish schedules and plans to meet deadlines.
Develop processes to support regulatory, internal audit, and industry-standard assessments and audits.
Coach, provide feedback to, and educate stakeholders and colleagues on regulatory compliance requirements and industry best practices.
Define and develop risk-management policies and procedures supporting implementation of enterprise technology controls.
Oversee preparation and submission of regulatory compliance reports to management, auditors, assessors, and regulators.
Oversee audits and assessments measuring security-control effectiveness and provide results to the responsible party or control owner.
Educate key stakeholders on risk-management frameworks and major regulatory compliance risks.
Coordinate process owners’ activities in support of regulatory audits, including responding to audit requests and tracking remediation.
Collaborate with senior management, Legal, Internal Audit, and external assessors to align and support the Regulatory Compliance Program.
Partner with IT and business colleagues to improve controls, processes, and systems, and provide actionable metrics on control effectiveness.