[Hiring] Senior Information Security Risk Auditor @UnitedHealth Group

Role Description

The key responsibilities of the role are as follows:

• Plan and execute risk-based assessments of control design and operating effectiveness across critical security domains (e.g., identity, access, network, cloud, data protection).
• Validate that controls are designed to mitigate identified risks and align with regulatory obligations (SOX, SOC 2, NYDFS) and leading frameworks (NIST CSF, ISO/IEC 27001).
• Review control documentation, evidence, and automation guardrails for completeness, accuracy, and scalability.
• Support the collection of data supporting regulatory and contractual obligations, coordinate reports, and conduct quality assurance of submitted evidence.
• Drive timely closure of control deficiencies identified during audits or regulatory reviews within defined SLAs.
• Facilitate control governance working groups and develop executive-ready summaries highlighting control effectiveness, risk implications, and required actions.
• Ensure interoperability between control governance processes and enterprise GRC platforms, continuously improving control assurance through dashboards, automation, and technology-enabled insights.
• Establish, mandate, and implement standard procedures and best practices to promote compliance with applicable laws and contractual obligations across UnitedHealth Group.

Qualifications

• High School Diploma.
• 5+ years of experience working in an IT auditing, information security risk management, IT regulatory compliance, or IT Audit role.
• 3+ years of experience interacting & collaborating with a variety of stakeholders (other team members, internal customers, and executives) and be able to provide measurable results without authority.
• 3+ years of experience implementing, monitoring and/or auditing IT general controls for application or platform environments.
• 3+ years of demonstrated knowledge of Agile software development, IT operations and logical security risks.
• 2+ years of experience working with enterprise GRC platforms, control testing workflows, and deficiency remediation tracking against defined SLAs.

Requirements

• Bachelor's degree or equivalent experience (preferred).
• Ability to navigate and manage ambiguity (preferred).
• Experience working in or auditing health related business operations (preferred).
• Experience with issuing Service Organization Controls (SOC) reports or is a certified CISA, CISM, CISSP or HITRUST assessor (preferred).
• Experience working with Mergers and Acquisitions or Non-Integrated Business Partners (preferred).
• Proven desire to make a positive impact with the ability to manage multiple tasks and shift priorities (preferred).

Benefits

• Comprehensive benefits package.
• Incentive and recognition programs.
• Equity stock purchase.
• 401k contribution (all benefits are subject to eligibility requirements).