[Hiring] Information Security Risk Auditor @UnitedHealth Group

Role Description

The Associate Information Security Risk Auditor (Compliance Management Lifecycle) is an early-career contributor responsible for supporting the assessment and validation of security risk policies and their associated standards across their full lifecycle. This role focuses on evaluating policies and their standards and testing against their requirements to confirm adherence.

• Control testing/ Action Plan Validation
  • Lead assessments of controls, action plans, processes
  • Validate that evidence accurately measures control effectiveness
  • Maintain audit-ready documentation and assist in tracking metric adherence and reporting accuracy
• Compliance & Evidence Review
  • Perform periodic reviews of controls and procedures to test for control effectiveness
  • Escalate control effectiveness gap delays in remediation
  • Support alignment verification against frameworks (e.g., NIST CSF, ISO 27001) and obligations (e.g., SOX, SOC 2)
• Stakeholder Support & Reporting
  • Prepare draft summary assessment results for management review
  • Participate in governance meetings and provide input on control validation status
  • Assist in control design efforts including inputs to governance routines and policy requirements
• Core Responsibilities
  • Conduct independent control and process validation
  • Support policy refresh reviews
  • Ensure audit documentation and evidence traceability are complete and accurate
  • Collaborate with risk and compliance teams to track remediation progress
  • Contribute to process improvement initiatives, including automation opportunities

Qualifications

• Associate’s degree (or higher) in Information Security, Risk Management, Business, or related field
• 3+ years of experience in information security auditing, compliance, or risk management as policy governance and control effectiveness
• 1+ years of experience working collaboratively across teams in a matrixed environment
• Intermediate level of experience with control design and operation, GRC tools, and evidence collection processes

Requirements

• Bachelor’s degree in Information Security, Risk Management, Business, or related field (preferred)
• Certifications such as CISA, CRISC (preferred)

Benefits

• Comprehensive benefits package
• Incentive and recognition programs
• Equity stock purchase
• 401k contribution (all benefits are subject to eligibility requirements)

Company Description

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone–of every race, gender, sexuality, age, location, and income–deserves the opportunity to live their healthiest life.

• Committed to mitigating our impact on the environment
• Enabling and delivering equitable care that addresses health disparities and improves health outcomes
• Equal Employment Opportunity employer under applicable law
• Drug-free workplace; candidates are required to pass a drug test before beginning employment