Senior BISO & Cyber Risk Leader — Enterprise Security

CVS Health Corporation; Kansas; Hybrid; USD 175,000 - 335,000; Full time

Benefits offered by this job

Comprehensive benefits

Bonuses and incentives

Equity awards

Job summary

CVS Health is seeking an Executive Director - Business Information Security Officer (BISO) to lead a world-class cybersecurity program across all lines of business. You will guide strategy, governance, and risk-driven decision making, partnering with senior IT and business leaders to embed security into initiatives.

This role requires 15+ years of leadership experience, deep GRC and security program expertise, and the ability to translate complex risks into business terms.

Qualifications

• 15+ years of experience in senior leadership roles with strategy, people leadership, and stakeholder management.
• 10+ years in a GRC or enterprise security program
• 5+ years as a BISO or Head BISO
• 5+ years aligning security controls with regulations (NIST/ISO/HITRUST/HIPAA/PCI)

Responsibilities

• Advise senior leadership and align cybersecurity practices with business initiatives across the lifecycle.
• Define and report KPIs to non-technical audiences for governance and insights.
• Drive risk management strategy and ownership of cross-functional security objectives.
• Lead or sponsor large-scale, cross-functional security initiatives with measurable outcomes.
• Develop executive communications and materials for senior stakeholders.

Skills

Leadership

Stakeholder management

Strategic thinking

Communication

Governance

Risk management

Education

Bachelor's degree

Tools

NIST

ISO

HITRUST

HIPAA

PCI

Job description

CVS Health is seeking an Executive Director - Business Information Security Officer (BISO) to lead a world-class cybersecurity program across all lines of business. You will guide strategy, governance, and risk-driven decision making, partnering with senior IT and business leaders to embed security into initiatives.

This role requires 15+ years of leadership experience, deep GRC and security program expertise, and the ability to translate complex risks into business terms.