CVS Health

Creates and drives the strategy and technology governance of Sarbanes-Oxley (SOX) Compliance, SOC Audits, HiTrust Assessments, FTC Compliance, regulatory assessments and responses and ensuring internal Audit planning and responses are aligned across DDAT (technology) executive teams.. 15+ years of compliance in information technology or information security with deep understanding of security controls and alignment to key regulations (examples: NIST, ISO, HITRUST, HIPAA, PCI). Must have at least 1 certification related to Information Security such as, CISA, CRISC, CISM or other industry audit, compliance or cybersecurity certification. Must have working knowledge of Regulatory standards, including NIST, SOX, SOC, FTC, HIPAA, PCI and HITRUST. Knowledge of GRC tools such as Archer or Process Unity

director technology

Bring your heart to CVS Health. Every one of us at CVS Health shares a single, clear purpose: Bringing our heart to every moment of your health. This purpose guides our commitment to deliver enhanced human-centric health care for a rapidly changing world. Anchored in our brand - with heart at its center - our purpose sends a personal message that how we deliver our services is just as important as what we deliver.
Our Heart At Work Behaviors support this purpose. We want everyone who works at CVS Health to feel empowered by the role they play in transforming our culture and accelerating our ability to innovate and deliver solutions to make health care more personal, convenient and affordable.
Position Summary
The Executive Director- Technology Compliance will direct a team of leaders and Sr level technical professionals responsible for driving the strategy, development and execution of technology and security compliance for CVS Health IT systems. Creates and drives the strategy and technology governance of Sarbanes-Oxley (SOX) Compliance, SOC Audits, HiTrust Assessments, FTC Compliance, regulatory assessments and responses and ensuring internal Audit planning and responses are aligned across DDAT (technology) executive teams.
This role interfaces with all levels of the organization, championing adoption of sustainable technology compliance practices and efficiencies across the enterprise with the goal of ensuring compliance requirements are proactively addressed. This role will be responsible for identifying and implementing opportunities for best in industry practice, reporting, and governance routines/processes while adhering to corporate policies, regulations and industry frameworks.
This leader will be able to work in a highly matrixed organization, build positive relationships with peers and enterprise leaders, and provide clear strategic direction for the program to support a high performing team. This role will be able to develop effective reporting and metrics for all activities in the DDAT compliance activities. This leader will interface as key technologies point of contact for executive leadership, internal and external audit, and ensure that audits and assessments are performed accurately to reflect the status of program controls within compliance timelines. This leader will monitor and drive remediation activities, escalating to create visibility where remediation is at risk. This leader must remain current and informed on regulatory requirements and industry practices working in collaboration with the government affairs, legal and privacy groups while ensuring technology colleagues understand and are trained in the related requirements.
Required Qualifications
<ul>
<li>15+ years of compliance in information technology or information security with deep understanding of security controls and alignment to key regulations (examples: NIST, ISO, HITRUST, HIPAA, PCI)</li>
<li>10+ years of leadership experience</li>
<li>12+ years of overall experience related to the following:</li>
<li>Demonstrated experience working with auditors and/or assessors from internal or external sources formulating responses, managing inquiries, and designing/overseeing remediation plans as necessary</li>
<li>Deep understanding of control frameworks, software delivery governance, and methodologies (SecDevOps, Waterfall, Project Management)</li>
<li>Deep understanding of regulations and industry assessments in the information technology and information security domains in insurance, privacy and/or healthcare focus areas</li>
<li>Demonstrated critical thinking and knowledge of risk management processes, tools, and techniques</li>
<li>
Advanced risk management experience in a complex organization and/or highly matrixed environment related to healthcare or healthcare related services, insurance, retail or similar industries.
</li>
<li>
Must have at least 1 certification related to Information Security such as, CISA, CRISC, CISM or other industry audit, compliance or cybersecurity certification
</li>
<li>Must have working knowledge of Regulatory standards, including NIST, SOX, SOC, FTC, HIPAA, PCI and HITRUST</li>
<li>10+ years of demonstrated experience with the following:</li>
<li>Experience leading and directing work with both internal and external partners in a highly collaborative environment</li>
<li>Ability to communicate clearly with a variety of stakeholders</li>
<li>Strong interpersonal and collaboration</li>
<li>Demonstrated experience in conflict resolution management and ability to challenge at all levels of management and influence business outcomes</li>
</ul>
Preferred Qualifications
<h3>Knowledge of</h3>
<ul>
<li>In depth knowledge of information security and technology risk management practices and principles</li>
<li>In depth knowledge of audit and control testing practices</li>
<li>Knowledge of privacy regulations as they pertain to PII/PHI</li>
<li>Knowledge of GRC tools such as Archer or Process Unity</li>
<li>Knowledge of audit and regulatory responses and procedures</li>
</ul>
<h3>Skill in</h3>
<ul>
<li>Program management and strategy</li>
<li>Process and functional mapping</li>
<li>Cyber security emerging and existing technology practices</li>
<li>Audit and compliance methodologies and governance</li>
<li>Risk metrics, monitoring and analysis</li>
<li>Large scale strategy formation and management</li>
<li>Program management</li>
</ul>
Education
Bachelor's degree or equivalent education or work experience
Pay Range
<h3>The typical pay range for this role is</h3>
$175,100.00 - $334,800.00
This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company's equity award program.
In addition to your compensation, enjoy the rewards of an organization that puts our heart into caring for our colleagues and our communities. The Company offers a full range of medical, dental, and vision benefits. Eligible employees may enroll in the Company's 401(k) retirement savings plan, and an Employee Stock Purchase Plan is also available for eligible employees. The Company provides a fully-paid term life insurance plan to eligible employees, and short-term and long term disability benefits. CVS Health also offers numerous well-being programs, education assistance, free development courses, a CVS store discount, and discount programs with participating partners. As for time off, Company employees enjoy Paid Time Off ("PTO") or vacation pay, as well as paid holidays throughout the calendar year. Number of paid holidays, sick time and other time off are provided consistent with relevant state law and Company policies.
For more detailed information on available benefits, please visit jobs.CVSHealth.com/benefits
We anticipate the application window for this opening will close on: 08/12/2024

START NEW SEARCH