Senior Info Sec Risk Auditor - Remote

Optum; Eden Prairie (MN); Remote; USD 92,000 - 164,000; Full time

Job summary

Optum Serve is hiring a Senior Information Security Risk Auditor to oversee cybersecurity assessments, ensure compliance with internal policies and federal standards, and drive remediation of control gaps.

The role supports remote work from anywhere in the U.S., with in-office requirements for certain locations. Strong planning, communication, and independence are essential to succeed in this challenging, collaborative environment.

Qualifications

• Undergraduate degree related to computer science, information technology or cybersecurity, or equivalent relevant work experience.
• 4+ years of relevant experience working with or assessing enterprise information technology and cybersecurity environments.
• 3+ years of experience applying federal cybersecurity standards such as NIST SP 800-53 and NIST SP 800-171.
• Demonstrated experience independently planning and executing IT or cybersecurity assessments and managing through to completion.
• Working knowledge of cybersecurity control domains such as IAM, privileged access, vulnerability management, configuration management, logging and monitoring, incident response, change management, network security, system development, backup and recovery, and third‑party risk management.
• Proven solid written and verbal communication skills, including the ability to communicate effectively with technical and non‑technical audiences.

Responsibilities

• Coordinate and manage engagements with third-party assessment organizations, including scope, schedules, evidence requests, and issue resolution.
• Plan and execute internal risk-based assessments of cybersecurity and IT controls against policy, contractual obligations, and federal requirements.
• Support security initiatives by collecting artifacts and aligning with control requirements.
• Identify, analyze, and communicate cybersecurity control deficiencies and track remediation with owners.
• Communicate professionally with technical teams, business leaders, and external stakeholders.

Skills

IT security risk

NIST 800-53/171

Third-party risk management

Communication skills

Independent planning

Education

Bachelor's degree in CS/IT/Cybersecurity

Job description

For those who want to invent the future of health care, here's your opportunity. We're going beyond basic care to health programs integrated across the entire continuum of care. Join us in making healthcare work better for everyone through people-led, responsible AI while Caring. Connecting. Growing together. As a Senior Information Security Risk Auditor within Optum Serve, you play a key role in ensuring Optum Serve's cybersecurity compliance with internal policies, federal regulations, and contractual security obligations. You will manage IT cybersecurity assessments with third-party assessment organizations that are necessary to meet contract requirements. In addition, you will proactively perform internal cybersecurity assessment, testing, and artifact collection to ensure expected compliance, identify control gaps, facilitate and monitor remediation, and validate that remediation has occurred. You will exercise sound assessment judgment and demonstrate independent initiative to succeed in this challenging role.

You'll enjoy the flexibility to work remotely * from anywhere within the U.S. as you take on some tough challenges. For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.

Primary Responsibilities

• Coordinate and manage controls assessment engagements with third-party assessment organizations, including scope, schedules, stakeholder participation, evidence requests, and issue resolution. Prepare control owners and subject‑matter experts for walkthroughs, interviews, and technical discussions with assessors
• Plan and execute internal risk‑based assessments of cybersecurity and IT controls including evaluation of control design, implementation, and operating effectiveness against internal policies, contractual obligations, federal requirements, and established control criteria
• Support internal company security initiatives, including managing stakeholder expectations and collecting and reviewing artifacts for completeness, consistency and alignment with control requirements
• Identify, analyze, and communicate cybersecurity control deficiencies; evaluate associated risk and potential impact; coordinate corrective action tracking with control owners; es
• Communicate professionally with technical teams, business leaders, end users, internal company contacts, and external stakeholders through multiple communication channels

Required Qualifications

• Undergraduate degree related to computer science, information technology or cybersecurity, or equivalent relevant work experience
• 4+ years of relevant experience working with or assessing enterprise information technology and cybersecurity environments, including cybersecurity assessments, IT audit, information security risk, compliance, or related assurance role
• 3+ years of experience applying federal cybersecurity standards such as NIST SP 800-53 and NIST SP 800-171
• Demonstrated experience independently planning and executing IT or cybersecurity assessments and managing through to completion
• Working knowledge of cybersecurity control domains such as identity and access management, privileged access, vulnerability management, configuration management, logging and monitoring, incident response, change management, network security, system development, backup and recovery, and third‑party risk management
• Proven solid written and verbal communication skills, including the ability to communicate effectively with technical and non‑technical audiences

Preferred Qualifications

• Professional certification such as CISA, CISSP, CRISC, CISM, or another relevant security, risk, or audit certification
• Experience coordinating external cybersecurity assessments or working directly with third‑party assessors
• Proven ability to initiate tasks and work independently
• Proven ability to evaluate and navigate complex technical challenges while effectively balancing competing priorities and stakeholder needs
• Proven ability to build and maintain rapport with cross‑functional leaders, peers, subordinates, internal company contacts and external stakeholders
• All employees working remotely will be required to adhere to UnitedHealth Group's Telecommuter Policy

Pay is based on several factors including but not limited to local labor markets, education, work experience, certifications, etc. In addition to your salary, we offer benefits such as a comprehensive benefits package, incentive and recognition programs, equity stock purchase and 401k contribution (all benefits are subject to eligibility requirements). No matter where or when you begin a career with us, you'll find a far‑reaching choice of benefits and incentives. The salary for this role will range from $91,700 - $163,700 annually based on full‑time employment. We comply with all minimum wage laws as applicable.

Application Deadline

This will be posted for a minimum of 2 business days or until a sufficient candidate pool has been collected. Job posting may come down early due to volume of applicants.

At UnitedHealth Group, our mission is to help people live healthier lives and help make the health system work better for everyone. Together, we are shaping the future of healthcare by harnessing technology and innovation to make care simpler to navigate, more affordable and more connected for the people we serve. We are committed to creating an inclusive workplace where everyone feels welcomed, valued, heard and respected, empowering people to bring their authentic selves to work and strengthening our collective impact through diverse talents, backgrounds, experiences and perspectives.

UnitedHealth Group and its affiliated brands are an Equal Employment Opportunity employer under applicable law and qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.

UnitedHealth Group and its affiliated brands are a drug‑free workplace. Candidates are required to pass a drug test before beginning employment.