Executive Director & BISO - Cyber Risk Strategy Leader

CVS Health Corporation; New Hampshire; Hybrid; USD 175,000 - 335,000; Full time

Benefits offered by this job

Bonus program

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking an Executive Director - Business Information Security Officer (BISO) to lead the enterprise cybersecurity program across all lines of business. You will partner with senior IT leaders and executives to translate security risk into business terms, drive governance, and oversee a high-performing BISO team.

The role requires deep experience in risk management, regulatory alignment, and effective communication of security vision to non-technical audiences.

Qualifications

• 15+ years of experience in senior leadership roles.
• 10+ years in a GRC or technical security program at enterprise scale.
• 5+ years as a BISO or Head BISO.

Responsibilities

• Serve as trusted advisor to business unit leadership and embed cybersecurity into initiatives.
• Define and report KPIs and metrics for senior leadership.
• Drive risk management strategy and objective ownership across teams.
• Lead cross-functional initiatives with timely execution and governance.
• Develop executive communications and reporting materials for stakeholders.
• Gather and analyze data to support decision-making and continuous improvement.

Skills

Strategic leadership

Stakeholder management

Executive communication

Risk management

Data-driven decision making

Team development

Cross-functional collaboration

Education

Bachelor's degree

Tools

GRC platforms

Job description

CVS Health is seeking an Executive Director - Business Information Security Officer (BISO) to lead the enterprise cybersecurity program across all lines of business. You will partner with senior IT leaders and executives to translate security risk into business terms, drive governance, and oversee a high-performing BISO team.

The role requires deep experience in risk management, regulatory alignment, and effective communication of security vision to non-technical audiences.