We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.
Position Summary
The AVP Security Risk Management isresponsiblefor reducing enterprisecybersecurityand technologyrisk by identifying, measuring, prioritizing, and driving treatment of materialcyberand technologyrisksacrossenterprise technology environments, business processes,third-party relationships, supply chain dependencies, andmerger, acquisition, and divestiture activity.
This leader defines the cyber and technology risk strategy, governance, assessment methods, control validation, and operating routines used to evaluate control effectiveness, threat exposure, technology, data, identity, resilience, third-party, and regulatory risk across internal and external stakeholders.
Reporting to the Deputy CISO, this collaborative leader partners with senior security, privacy, risk, legal, technology, procurement, corporate development, integration, and business leaders.The AVPconvertsinternal and external cybersecurityand technologyrisk intelligence—including enterprise control gaps,technology control deficiencies,emerging threats,third-partyexposure, supply chaindependencies, and M&Arisk—into measurable risk decisions, remediation priorities, control requirements, and executivereporting that help protect CVS Health’s members, colleagues, protected health information, confidential data, critical systems, operations, and brand.
Key Responsibilities:
- Evolve CVS Health’s cybersecurityand technologyrisk management program as a core component of the enterprise cyberand technologyrisk strategy, including risk taxonomy, risk appetite alignment, assessment methodology,internal and external risk identification,inherent and residual risk scoring,technology and securitycontrol validation, governance routines, issue management, and executive risk reporting.
- Lead the end-to-end lifecycle of third-party cybersecurity risk assessments — including pre-contract due diligence, security architecture review, onboarding, periodic reassessment, continuous monitoring, offboarding, and risk acceptance — across thousands of vendors and business associates, ensuring decisions are transparent, evidence-based, and aligned to enterprise risk appetite.
- Integrate internal enterprise risk signals and externalthird-party, supply chain, and M&A cyberand technologyrisk signals into CVS Health’s enterprise risk posture by identifying systemic exposure, technology concentration risk, control gaps, ransomware exposure, data protection risk, identity and access risk, cloud and infrastructure risk,application and platform risk,software supply chain risk,technology resilience risk,and emerging threat trends.
- Lead M&A Security onboarding activities by partnering with Corporate Development, Integration Management, Legal, Privacy, Technology, and cybersecurity teams to assess cyber risk during due diligence; evaluate security architecture, identity, data, endpoint, network, vulnerability, cloud, and third-party exposures; define integration security requirements; prioritize remediation; and support secure onboarding of acquired entities, assets, applications, users, suppliers, and data into CVS Health’s security control environment.
- Lead M&A Security offboarding activities for divestitures, separations, and transition services by defining cybersecurity exit requirements; coordinating secure separation of data, identities, privileged access, applications, infrastructure, network connectivity, endpoints, logging, monitoring, and vendors; validating control ownership; and ensuring cyber risk, regulatory, contractual, and transition service obligations are addressed through transaction close and transition exit.
- Partner with Security Architecture, Security Operations, Vulnerability Management, Identity and Access Management, Cloud Security, Data Protection,Technology,Privacy, Legal, Enterprise Risk, Procurement, Corporate Development, Integration Management, and business leaders to embed cybersecurityand technologycontrol requirements into sourcing, contracting, vendor governance, acquisition integration, divestiture planning,technology delivery,and operational risk decisions.
- Serve as a trusted cybersecurity risk advisor to internal stakeholders and external parties — including vendors, suppliers, acquired or divested entities, industry peer groups, regulators, and client due diligence teams — building relationships that strengthen cyber risk decision-making and drive shared accountability for control effectiveness and risk remediation.
- Collaborate closely with the CISO, DCISOand Chief Privacy Officer (CPO) on cybersecurityand technologyrisk strategy, regulatory readiness, cyberand technologycontrol posture, material risk escalation, and governance of third-party, supply chain, M&A, and enterprise cyberand technologyrisk issues.
- Establish and report cybersecurityand technologykey risk indicators, key performance indicators, metrics, trends, and material risk themes that provide senior leadership with clear visibility intointernal and externalinherent risk, residual risk, control maturity, remediation progress, high-risk vendors,technology control issues,transaction-related cyberand technologyexposures, and contribution to overallenterpriserisk posture.
- Drive cybersecurityand technologyrisk treatment, remediation governance, issue management, compensating controls, exception management, and risk acceptancefor both internal control gaps and external exposures, workingwith vendors, business owners,technology owners,transaction teams, integration teams, vendor relationshipmanagers, and enterprise risk stakeholdersto escalatehigh-risk findings and material exposures through closure.
- Evaluate and implement cybersecurity risk management tools, GRC capabilities, security ratings services, continuous monitoring platforms, control assessment automation, and data analytics that improve scalability, evidence quality, remediation tracking, and enterprise-level visibility into cyber risk trends and control effectiveness.
- Represent CVS Health in regulatory examinations, client due diligence reviews, transaction-related reviews, and audits related to cybersecurity risk management, third-party security oversight, supply chain security, M&A security, and cyber control governance.
- Stay current on emerging cyber threats, adversary tactics, regulatory expectations, healthcare cyber risk trends, ransomware risk, cloud and identity risk, software supply chain risk, AI/ML vendor risk, and transaction-related cyber risk domains, adapting the program to strengthen enterprise resilience.
- Lead and develop a high-performing cybersecurity risk management team through collaborative, inclusive leadership — fostering accountability, technical depth, business partnership, risk discipline, continuous improvement, and bench strength across the team.
Required Qualifications
- 10+ years of progressive experience in information security, cybersecurity risk management, technology risk, or IT audit, including 5+ years focused on third-party, vendor, supplier, supply chain, or M&A cyber risk management.
- Demonstrated experience designing,operating, and maturing cybersecurityand technologyrisk management programs across a large, complex enterprise, includinginternal and externalrisk assessmentmethodology, inherent and residual risk scoring,technology and securitycontrol validation, issue management, risk acceptance, and executive reporting.
- Experience evaluating cybersecurityand technologycontrol domains such as identity and access management, privileged access, vulnerability management, endpoint security, cloud security, network security, logging and monitoring, data protection, incident response readiness, application security,infrastructure, platform, change management,business continuity, anddisaster recovery.
- Experience supporting merger, acquisition, divestiture, separation, or transition services activities from a cybersecurity risk perspective, including cyber due diligence, security integration planning, control gap remediation, secure onboarding, and secure offboarding requirements.
- 3+ years ofpeopleleadership experience, including building, leading, and managing high-performing teams of security or risk professionals through collaborative, inclusive leadership.
- Strong leadership and collaboration skills, with a demonstrated ability to build and manage key internal and external collaborative relationships across a matrixed enterprise.
- Strong working knowledge of cybersecurity and privacy frameworks and regulations relevant to healthcare and insurance, including HIPAA, NIST CSF, NIST 800-53, ISO 27001, HITRUST, SOC 2, PCI DSS, and other applicable regulatory or contractual requirements.
- Experience with third-party risk management (TPRM), governance, risk, and compliance (GRC) platforms, security ratings services, continuous monitoring capabilities,technology risk reporting,and cyber risk reporting tools.
- Proven ability to influence senior stakeholders and lead cross-functional partnerships with internal groups — including the CISO, Deputy CISO, CPO, Security Architecture, Security Operations, Identity and Access Management, Vulnerability Management, Cloud Security, Data Protection, Enterprise Third-Party Vendor Management, Procurement, Legal, Privacy, Enterprise Risk, Technology, Corporate Development, Integration Management, and business units — as well as external partners such as vendors, suppliers, transaction partners, and industry peers, to drive risk-informed cybersecurity decisions.
- Excellent written and verbal communication skills, including the ability to translate complexinternal and externalcybersecurityand technologyrisk, threat exposure, control effectiveness,technology control issues,and remediationmattersinto clear, business-relevant insights for executive leadership, governance committees, regulators, clients, and Board-level audiences.
- Bachelor's degree in Computer Science, Information Security, Cybersecurity, Business, or related field, or equivalent professional experience
Preferred Qualifications
- Relevant industry certifications such as CISSP, CISM, CRISC, CTPRP, CCSP, CISA, or HCISPP.
- Experience in healthcare, health insurance, pharmacy, or retail industries with large, complex vendor ecosystems and regulated data environments.
- Master's degree or Juris Doctor with relevant cybersecurity, technology risk, privacy, or regulatory experience.
- Familiarity with cyberand technologyrisk quantification, control maturity models, threat-informed risk assessment, continuous control monitoring,technology resilience,cloud security posture, fourth-party risk, AI/ML vendor risk, software supply chain risk,enterprise risk aggregation practices, and transaction-related cybersecurityand technologyrisk management.
- Experience supporting regulatory examinations, client due diligence reviews, transaction diligence, or audits related to cybersecurity risk management, third-party security oversight, supply chain security, or M&A security activities.
This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program.
Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.
Great benefits for great people
We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.
This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.
Additional details about available benefits are provided during the application process and on Benefits Moments.
We anticipate the application window for this opening will close on: 09/02/2026
Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.
