Senior Info Sec Risk Auditor - Remote

UnitedHealth Group; Eden Prairie (MN); Remote; USD 92,000 - 164,000; Full time

Benefits offered by this job

Benefits package

Incentive & recognition programs

Equity stock purchase

401k contribution

Job summary

UnitedHealth Group (Optum Serve) seeks a Senior Information Security Risk Auditor to lead IT cybersecurity assessments and ensure compliance with internal policies and federal requirements. The role involves coordinating with third-party assessors, evaluating control design and operation, and guiding remediation efforts across the organization.

The position offers remote work across the U.S. with in-office presence required for Minneapolis or DC area staff at least four days per week.

Qualifications

• Undergraduate degree related to computer science, information technology or cybersecurity, or equivalent relevant work experience.
• 4+ years of experience in enterprise IT and cybersecurity environments, including IT audit, risk, or compliance.
• 3+ years applying federal cybersecurity standards (NIST SP 800-53/171).
• Experience planning and executing IT or cybersecurity assessments independently.
• Knowledge of IAM, privileged access, vulnerability mgmt, and related control domains.
• Proven written and verbal communication skills with technical and non-technical audiences.

Responsibilities

• Coordinate and manage third-party controls assessment engagements with scope, schedules, and evidence requests.
• Plan and execute internal risk-based assessments of cybersecurity and IT controls.
• Support security initiatives, collecting artifacts and ensuring alignment with control requirements.
• Identify, analyze, and communicate control deficiencies; track remediation and closure.
• Communicate with technical teams, business leaders, and external stakeholders.

Skills

IT audit

Cybersecurity assessments

NIST 800-53/171

Third-party risk

Identity & access management

Vulnerability management

Change management

Network security

Written communications

Education

Undergraduate degree in CS/IT/Cybersecurity

Job description

For those who want to invent the future of health care, here's your opportunity. We're going beyond basic care to health programs integrated across the entire continuum of care. Join us in making healthcare work better for everyone through people-led, responsible AI while Caring. Connecting. Growing together.

As a Senior Information Security Risk Auditor within Optum Serve, you play a key role in ensuring Optum Serve's cybersecurity compliance with internal policies, federal regulations, and contractual security obligations. You will manage IT cybersecurity assessments with third-party assessment organizations that are necessary to meet contract requirements. In addition, you will proactively perform internal cybersecurity assessment, testing, and artifact collection to ensure expected compliance, identify control gaps, facilitate and monitor remediation, and validate that remediation has occurred. You will exercise sound assessment judgment and demonstrate independent initiative to succeed in this challenging role.

You’ll enjoy the flexibility to work remotely * from anywhere within the U.S. as you take on some tough challenges. For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.

Primary Responsibilities:

• Coordinate and manage controls assessment engagements with third-party assessment organizations, including scope, schedules, stakeholder participation, evidence requests, and issue resolution. Prepare control owners and subject-matter experts for walkthroughs, interviews, and technical discussions with assessors
• Plan and execute internal risk-based assessments of cybersecurity and IT controls including evaluation of control design, implementation, and operating effectiveness against internal policies, contractual obligations, federal requirements, and established control criteria
• Support internal company security initiatives, including managing stakeholder expectations and collecting and reviewing artifacts for completeness, consistency and alignment with control requirements
• Identify, analyze, and communicate cybersecurity control deficiencies; evaluate associated risk and potential impact; coordinate corrective action tracking with control owners; elevate overdue or unresolved issues as appropriate; and validate remediation prior to closure
• Communicate professionally with technical teams, business leaders, end users, internal company contacts, and external stakeholders through multiple communication channels

You’ll be rewarded and recognized for your performance in an environment that will challenge you and give you clear direction on what it takes to succeed in your role as well as provide development for other roles you may be interested in.

Required Qualifications:

• Undergraduate degree related to computer science, information technology or cybersecurity, or equivalent relevant work experience
• 4+ years of relevant experience working with or assessing enterprise information technology and cybersecurity environments, including cybersecurity assessments, IT audit, information security risk, compliance, or related assurance role
• 3+ years of experience applying federal cybersecurity standards such as NIST SP 800-53 and NIST SP 800-171
• Demonstrated experience independently planning and executing IT or cybersecurity assessments and managing through to completion
• Working knowledge of cybersecurity control domains such as identity and access management, privileged access, vulnerability management, configuration management, logging and monitoring, incident response, change management, network security, system development, backup and recovery, and third-party risk management
• Proven solid written and verbal communication skills, including the ability to communicate effectively with technical and non-technical audiences

Preferred Qualifications:

• Professional certification such as CISA, CISSP, CRISC, CISM, or another relevant security, risk, or audit certification
• Experience coordinating external cybersecurity assessments or working directly with third-party assessors
• Proven ability to initiate tasks and work independently
• Proven ability to evaluate and navigate complex technical challenges while effectively balancing competing priorities and stakeholder needs
• Proven ability to build and maintain rapport with cross-functional leaders, peers, subordinates, internal company contacts and external stakeholders

*All employees working remotely will be required to adhere to UnitedHealth Group's Telecommuter Policy

Pay is based on several factors including but not limited to local labor markets, education, work experience, certifications, etc. In addition to your salary, we offer benefits such as,

• a comprehensive benefits package
• incentive and recognition programs
• equity stock purchase
• 401k contribution (all benefits are subject to eligibility requirements)

No matter where or when you begin a career with us, you'll find a far-reaching choice of benefits and incentives. The salary for this role will range from $91,700 - $163,700 annually based on full-time employment. We comply with all minimum wage laws as applicable.

Application Deadline:

This will be posted for a minimum of 2 business days or until a sufficient candidate pool has been collected. Job posting may come down early due to volume of applicants.

At UnitedHealth Group, our mission is to help people live healthier lives and help make the health system work better for everyone. Together, we are shaping the future of healthcare by harnessing technology and innovation to make care simpler to navigate, more affordable and more connected for the people we serve. We are committed to creating an inclusive workplace where everyone feels welcomed, valued, heard and respected, empowering people to bring their authentic selves to work and strengthening our collective impact through diverse talents, backgrounds, experiences and perspectives.

UnitedHealth Group and its affiliated brands are an Equal Employment Opportunity employer under applicable law and qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.

UnitedHealth Group and its affiliated brands are a drug-free workplace. Candidates are required to pass a drug test before beginning employment.