Accounting · Permanent
Senior Info Sec Risk Auditor - Remote
UnitedHealth Group · Minnesota, United States
- Location: Minnesota, United States
- Employment: Permanent
Job description
Overview
As a Senior Information Security Risk Auditor within Optum Serve, you will drive cybersecurity assessments to ensure compliance with policies, regulations, and contractual obligations. You will coordinate third party assessments and conduct internal risk-based evaluations to identify gaps, oversee remediation, and validate outcomes. The role blends independent judgment with stakeholder collaboration to strengthen security controls across the enterprise. This is a remote-friendly opportunity with in-office requirements in certain locations, offering meaningful impact in healthcare tech and security. You will help safeguard patient data while enabling trusted innovation.
Compensation / Benefits
• comprehensive benefits package
• equity stock purchase
• 401k contribution
• telecommuter policy
Responsibilities
• Coordinate and manage third party assessment engagements (scope, schedules, evidence requests, issue resolution)
• Prepare control owners for walkthroughs, interviews, and technical discussions with assessors
• Plan and execute internal risk-based cybersecurity assessments against policies, contracts, and regulatory requirements
• Support security initiatives by collecting and reviewing artifacts for completeness and alignment
• Identify, analyze, and communicate control deficiencies; assess risk and coordinate remediation; verify closure
• Communicate with technical teams, business leaders, and external stakeholders across channels
Key requirements
• 4+ years in information technology cybersecurity, auditing, risk, compliance, or related assurance
• 3+ years applying NIST SP 800-53 and NIST SP 800-171
• Experience planning and executing IT/cybersecurity assessments from start to finish
• Working knowledge of IAM, privileged access, vulnerability management, configuration, logging, incident response, change management, network security
• Strong written and verbal communication with technical and non-technical audiences
• independence and initiative
• stakeholder management
• clear communication
• NIST SP 800-53
• NIST SP 800-171
• identity and access management
As a Senior Information Security Risk Auditor within Optum Serve, you will drive cybersecurity assessments to ensure compliance with policies, regulations, and contractual obligations. You will coordinate third party assessments and conduct internal risk-based evaluations to identify gaps, oversee remediation, and validate outcomes. The role blends independent judgment with stakeholder collaboration to strengthen security controls across the enterprise. This is a remote-friendly opportunity with in-office requirements in certain locations, offering meaningful impact in healthcare tech and security. You will help safeguard patient data while enabling trusted innovation.
Compensation / Benefits
• comprehensive benefits package
• equity stock purchase
• 401k contribution
• telecommuter policy
Responsibilities
• Coordinate and manage third party assessment engagements (scope, schedules, evidence requests, issue resolution)
• Prepare control owners for walkthroughs, interviews, and technical discussions with assessors
• Plan and execute internal risk-based cybersecurity assessments against policies, contracts, and regulatory requirements
• Support security initiatives by collecting and reviewing artifacts for completeness and alignment
• Identify, analyze, and communicate control deficiencies; assess risk and coordinate remediation; verify closure
• Communicate with technical teams, business leaders, and external stakeholders across channels
Key requirements
• 4+ years in information technology cybersecurity, auditing, risk, compliance, or related assurance
• 3+ years applying NIST SP 800-53 and NIST SP 800-171
• Experience planning and executing IT/cybersecurity assessments from start to finish
• Working knowledge of IAM, privileged access, vulnerability management, configuration, logging, incident response, change management, network security
• Strong written and verbal communication with technical and non-technical audiences
• independence and initiative
• stakeholder management
• clear communication
• NIST SP 800-53
• NIST SP 800-171
• identity and access management