Executive BISO Leader: Enterprise Security & Risk

CVS Health Corporation; Wisconsin; Hybrid; USD 175,000 - 335,000; Full time

Benefits offered by this job

Comprehensive benefits package

Bonus program

Equity awards

Job summary

CVS Health Corporation is seeking an Executive Director - Business Information Security Officer (BISO) to lead the BISO function across CVS Health lines of business. The role requires strategic leadership, governance, risk management, and effective communication with senior IT and business leaders.

You will drive enterprise cybersecurity strategy, embed security decisions in business terms, and influence across large-scale initiatives.

Qualifications

• 15+ years of senior leadership experience in strategy, people leadership and complex stakeholder management.
• 10+ years in either a GRC or a technical security program at enterprise scale.
• 5+ years of direct experience as a BISO or Head BISO.
• 5+ years of experience with two or more security control frameworks (NIST, ISO, HITRUST, HIPAA, PCI).
• 5+ years of experience in Program and Project Management with cross-functional initiatives.
• 5+ years partnering with business unit leaders to translate cybersecurity risk into business terms.

Responsibilities

• Serve as a trusted advisor to business unit leadership integrating cybersecurity into initiatives.
• Define and report KPIs and metrics to senior leadership in accessible terms.
• Drive risk management by setting security objectives and prioritizing execution across teams.
• Lead cross-functional projects ensuring alignment with strategic goals and governance.

Skills

Strategic leadership

Security governance

KPIs & metrics

Executive communication

Stakeholder management

Risk-informed decision-making

BISO experience

Program & project management

Education

Bachelor's degree

Job description

CVS Health Corporation is seeking an Executive Director - Business Information Security Officer (BISO) to lead the BISO function across CVS Health lines of business. The role requires strategic leadership, governance, risk management, and effective communication with senior IT and business leaders.

You will drive enterprise cybersecurity strategy, embed security decisions in business terms, and influence across large-scale initiatives.