Executive BISO Leader for Enterprise Cyber Risk & Equity

CVS Health Corporation; Arizona; Hybrid; USD 175,000 - 335,000; Full time

Job summary

CVS Health Corporation is seeking an Executive Director - Business Information Security Officer (BISO) to lead the BISO function, align security with business strategy, and drive enterprise cybersecurity initiatives. This role partners with senior IT leaders and business SMEs to embed risk-based decision making into key programs.

The ideal candidate has extensive leadership experience in GRC, information security programs, and experience translating risk into business terms, with a track record

Qualifications

• 15+ years of senior leadership experience in security/RIS governance.
• 5+ years as BISO or Head BISO with cross-functional scope.
• Experience translating cybersecurity risk into business terms.

Responsibilities

• Advise business units; embed security into initiatives across the lifecycle.
• Define and report KPIs to senior leadership with clear business context.
• Drive risk management by setting objectives and prioritizing work across teams.
• Lead跨-functional projects and ensure timely execution and governance.
• Develop communications for internal and external stakeholders.
• Analyze data to support decisions and drive continuous improvement.
• Lead governance meetings and ensure action items are tracked.
• Monitor laws/regulations and advise IT leadership on impact.
• Negotiate to reduce complexity of security controls enterprise-wide.
• Motivate units to adopt controls and communicate policy changes.
• Develop and coach BISO team members with clear objectives.

Skills

Strategic leadership

Security governance

Stakeholder management

Risk communication

Education

Bachelor's degree

Tools

GRC tooling

NIST/ISO/HITRUST knowledge

Job description

CVS Health Corporation is seeking an Executive Director - Business Information Security Officer (BISO) to lead the BISO function, align security with business strategy, and drive enterprise cybersecurity initiatives. This role partners with senior IT leaders and business SMEs to embed risk-based decision making into key programs.

The ideal candidate has extensive leadership experience in GRC, information security programs, and experience translating risk into business terms, with a track record