Remote Governance Risk Compliance Jobs (NOW HIRING)

Position Summary

The AVP Governance, Risk & Compliance (GRC) leads the strategy, design, and execution of CVS Health's enterprise information security governance, risk management, technology compliance, and regulatory compliance program, including the modernization of GRC through automation, evidence reuse, and AI-assisted risk quantification and reporting.

Reporting to the Deputy CISOandpartneringclosely withthe CISO, this leadermanagescybersecurity risk posture,controls, technology compliance, and regulatory obligationswhile driving continuous improvement.The AVP builds trustedrelationships acrossSecurity,Third-Party Risk,Audit, Legal, Finance,regulators,vendors,and businessleaders to translate risk into clear,actionable priorities.

Key Responsibilities

• Lead the development and execution of CVS Health's enterprise information security governance, risk, technology compliance, and regulatory compliance strategy, aligned to businessobjectivesand enterprise risk appetite, working in close partnership with both the CISO and Deputy CISO.

• Drive the cybersecurity risk assessment program - identification, quantification, tracking, and remediation of risk - and report risk posture and trends to the Deputy CISO, CISO, and leadership committees.

• Lead the modernization and automation of GRC capabilities, includingevidencereuse, automated control testing, and AI-assisted risk quantification and reporting, to improve speed, accuracy, and scalability of the program.

• Ensure the security program's continued compliance with the full range of regulatory and industry requirements applicable to cybersecurity in healthcare - including HIPAA, HITECH, 42 CFR Part 2, CMS security and privacy requirements, FDA requirements where applicable, state insurance and privacy laws, PCI DSS,SOX, SOC 1/SOC 2,and SEC cybersecurity disclosure requirements - as well as other frameworks relevant to CVS Health's retail, pharmacy, and health services lines of business.

• Own enterprise technology compliance for cybersecurity, ensuring technology controls, configurations, and platforms across the enterprise meet applicable regulatory, contractual, and internal policy requirements.

• Direct the lifecycle of enterprise information security policies, standards, and procedures, ensuring theyremaincurrent, enforceable, and aligned to NIST CSF, ISO 27001, HITRUST CSF, and other adopted control frameworks.

• Serve as the primary GRC liaison to Internal Audit, external auditors, and regulators; coordinate audit and examination responses and drivetimelyremediation of findings.

• Oversee SOX cybersecurity and IT general control support, including coordination with Finance, Internal Audit, control owners, and external auditors to define control scope,validateevidence, track deficiencies, and supporttimelyremediation.

• Lead SOC 1 and SOC 2 readiness and attestation support for applicable services and platforms, including control mapping, evidence management, audit coordination, exception handling, and continuous improvement of trust services control coverage.

• Own the security exception and risk acceptance process, ensuringappropriate executivevisibility and accountability for accepted risk.

• Establish and lead enterprise AI risk governance, including oversight of AI-related security, privacy, and regulatory risk across internally developed and third-party AI capabilities.

• PartnerwithSecurityRisk Management leadership to ensure the enterprise risk framework, control taxonomy, and reporting are aligned with the vendor risk program, without duplicating ownership.

• Buildstrongpartnerships with internalandexternalstakeholdersto strengthen alignment, resolve issues, and advance enterprise risk and complianceobjectives.

• Prepare and deliver regular cybersecurity risk posture reporting to the Board Risk/Audit Committee and other executive governance forums.

• Manage and mature GRC tooling and platforms to support risk quantification, control testing, and reporting automation.

• Lead and develop the GRC team,buildingsuccession bench strength, andfosteringa culture of accountability, continuous improvement, business partnership, and effective change leadership through organizational transformation.

Required Qualifications

• Bachelor's degree in Information Security, Computer Science, Risk Management, or a related field, or equivalent professional experience.

• 10+ years of progressive experience in information security, IT risk management, or regulatory compliance, including 5+ years in a leadership role.

• Deep working knowledge of regulatory and control frameworks applicable to a large, regulated enterprise, including HITRUST CSF, SOX IT general controls, SOC 1/SOC 2, NIST CSF, ISO 27001, and related cybersecurity control frameworks.

• Demonstrated experience building or scaling an enterprise GRC program, including risk assessment and policy management.

• Hands-on experience with GRC platforms and risk quantification/reporting tools, including automation andevidencereuse capabilities.

• Proven ability to communicate risk and compliance matters clearly to executive leadership, Board committees, auditors, and regulators.

• Demonstrated executive presence, with the ability to influence senior leaders, represent the GRC function in executive forums, and communicate complex risk and compliance matters with clarity, credibility, and sound judgment.

• Experience partnering with Internal Audit and managing external regulatory examinations.

• Experience supporting SOX control testing, SOC readiness or attestation activities, audit evidence collection, control deficiency remediation, and executive-level reporting on compliance posture.

• Experienceoperatingwithin a matrixed, multi-business-unit enterprise (e.g., retail, pharmacy, health services, or similarly complex organizational structures).

• Proven ability to lead through influence and build trusted relationships across internal and external partner groups, including senior business leaders, technology teams, Legal, Finance, Internal Audit, regulators, external auditors, consultants, and third-party service providers.

• Proven enterprisepeopleleadership and talent management experience, including building, developing, coaching, andretaininghigh-performing teams; cultivating succession bench strength; and leading leaders through organizational change.

Preferred Qualifications

• Advanced degree (MBA or MS) in a related discipline, or JD withcybersecurity and risk focus.

• Relevant certifications such as CISSP, CISM, CISA, CRISC, or CIPP.

• Experience in healthcare, pharmacy, health insurance, or retail industries.

• Experience with AI governance, model risk management, or emerging AIregulation.

• Familiarity with SEC cybersecurity disclosure requirements and materiality assessment processes.