Remote Director, Cyber Risk & GRC Strategy

Cardinal Health; United States; On-site; USD 137,000 - 232,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off plan

Health savings account (HSA)

401k savings plan

MyFlexPay access to wages early

Flexible spending accounts (FSAs)

Disability coverage

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health is seeking a Director of Information Security and Risk to lead the cybersecurity risk management program, embedding risk throughout enterprise decisions and driving governance across ERM, regulatory requirements, and business objectives.

You will oversee risk framework development, third-party risk management, remediation, and executive reporting while building a high-performing team and coordinating with security architecture, IT, legal, and audit.

Qualifications

• 8+ years in cybersecurity, risk management or information security with focus on cyber risk and governance.
• Expertise in cybersecurity risk management frameworks, methodologies, and enterprise risk integration.
• Experience leading risk assessment programs, risk remediation efforts, and third-party risk management.
• Professional certifications such as CISSP, CISM, CRISC or CISA preferred.

Responsibilities

• Develop and lead the cybersecurity risk management strategy aligned with ERM frameworks, business objectives and regulatory expectations.
• Collaborate with enterprise stakeholders to define risk priorities, methodologies, and governance structures.
• Lead development and enhancement of GRC tools and platforms for risk, control and compliance management.
• Oversee third-party risk management program including vendor assessments and onboarding.
• Define risk metrics, KPIs and KRIs, and deliver executive reporting on risk posture.
• Partner with ERM teams to align cybersecurity risks with broader risk framework.
• Guide risk remediation, vulnerability management, and escalation processes across teams.

Skills

Cybersecurity risk management

GRC leadership

Regulatory compliance

Executive reporting

Stakeholder management

Vendor/third-party risk

Job description

Cardinal Health is seeking a Director of Information Security and Risk to lead the cybersecurity risk management program, embedding risk throughout enterprise decisions and driving governance across ERM, regulatory requirements, and business objectives.

You will oversee risk framework development, third-party risk management, remediation, and executive reporting while building a high-performing team and coordinating with security architecture, IT, legal, and audit.