Assistant Vice President (AVP) Governance, Risk & Compliance (GRC)

Position Summary 

The AVP Governance, Risk & Compliance (GRC) leads the strategy, design, and execution of CVS Health's enterprise information security governance, risk management, technology compliance, and regulatory compliance program, including the modernization of GRC through automation, evidence reuse, and AI-assisted risk quantification and reporting. 

Reporting to the Deputy CISO and partnering closely with the CISO, this leader manages cybersecurity risk posture, controls, technology compliance, and regulatory obligations while driving continuous improvement. The AVP builds trusted relationships across Security, Third-Party Risk, Audit, Legal, Finance, regulators, vendors, and business leaders to translate risk into clear, actionable priorities. 

Key Responsibilities 

• Lead the development and execution of CVS Health's enterprise information security governance, risk, technology compliance, and regulatory compliance strategy, aligned to business objectives and enterprise risk appetite, working in close partnership with both the CISO and Deputy CISO. 

• Drive the cybersecurity risk assessment program — identification, quantification, tracking, and remediation of risk — and report risk posture and trends to the Deputy CISO, CISO, and leadership committees. 

• Lead the modernization and automation of GRC capabilities, including evidence reuse, automated control testing, and AI-assisted risk quantification and reporting, to improve speed, accuracy, and scalability of the program. 

• Ensure the security program's continued compliance with the full range of regulatory and industry requirements applicable to cybersecurity in healthcare — including HIPAA, HITECH, 42 CFR Part 2, CMS security and privacy requirements, FDA requirements where applicable, state insurance and privacy laws, PCI DSS, SOX, SOC 1/SOC 2, and SEC cybersecurity disclosure requirements — as well as other frameworks relevant to CVS Health's retail, pharmacy, and health services lines of business. 

• Own enterprise technology compliance for cybersecurity, ensuring technology controls, configurations, and platforms across the enterprise meet applicable regulatory, contractual, and internal policy requirements. 

• Direct the lifecycle of enterprise information security policies, standards, and procedures, ensuring they remain current, enforceable, and aligned to NIST CSF, ISO 27001, HITRUST CSF, and other adopted control frameworks. 

• Serve as the primary GRC liaison to Internal Audit, external auditors, and regulators; coordinate audit and examination responses and drive timely remediation of findings. 

• Oversee SOX cybersecurity and IT general control support, including coordination with Finance, Internal Audit, control owners, and external auditors to define control scope, validate evidence, track deficiencies, and support timely remediation. 

• Lead SOC 1 and SOC 2 readiness and attestation support for applicable services and platforms, including control mapping, evidence management, audit coordination, exception handling, and continuous improvement of trust services control coverage. 

• Own the security exception and risk acceptance process, ensuring appropriate executive visibility and accountability for accepted risk. 

• Establish and lead enterprise AI risk governance, including oversight of AI-related security, privacy, and regulatory risk across internally developed and third-party AI capabilities. 

• Partner with Security Risk Management leadership to ensure the enterprise risk framework, control taxonomy, and reporting are aligned with the vendor risk program, without duplicating ownership. 

• Build strong partnerships with internal and external stakeholders to strengthen alignment, resolve issues, and advance enterprise risk and compliance objectives. 

• Prepare and deliver regular cybersecurity risk posture reporting to the Board Risk/Audit Committee and other executive governance forums. 

• Manage and mature GRC tooling and platforms to support risk quantification, control testing, and reporting automation. 

• Lead and develop the GRC team, building succession bench strength, and fostering a culture of accountability, continuous improvement, business partnership, and effective change leadership through organizational transformation. 

Required Qualifications 

• Bachelor's degree in Information Security, Computer Science, Risk Management, or a related field, or equivalent professional experience. 

• 10+ years of progressive experience in information security, IT risk management, or regulatory compliance, including 5+ years in a leadership role. 

• Deep working knowledge of regulatory and control frameworks applicable to a large, regulated enterprise, including HITRUST CSF, SOX IT general controls, SOC 1/SOC 2, NIST CSF, ISO 27001, and related cybersecurity control frameworks. 

• Demonstrated experience building or scaling an enterprise GRC program, including risk assessment and policy management. 

• Hands-on experience with GRC platforms and risk quantification/reporting tools, including automation and evidence reuse capabilities. 

• Proven ability to communicate risk and compliance matters clearly to executive leadership, Board committees, auditors, and regulators. 

• Demonstrated executive presence, with the ability to influence senior leaders, represent the GRC function in executive forums, and communicate complex risk and compliance matters with clarity, credibility, and sound judgment. 

• Experience partnering with Internal Audit and managing external regulatory examinations. 

• Experience supporting SOX control testing, SOC readiness or attestation activities, audit evidence collection, control deficiency remediation, and executive-level reporting on compliance posture. 

• Experience operating within a matrixed, multi-business-unit enterprise (e.g., retail, pharmacy, health services, or similarly complex organizational structures). 

• Proven ability to lead through influence and build trusted relationships across internal and external partner groups, including senior business leaders, technology teams, Legal, Finance, Internal Audit, regulators, external auditors, consultants, and third-party service providers. 

• Proven enterprise people leadership and talent management experience, including building, developing, coaching, and retaining high-performing teams; cultivating succession bench strength; and leading leaders through organizational change. 

Preferred Qualifications 

• Advanced degree (MBA or MS) in a related discipline, or JD with cybersecurity and risk focus.   

• Relevant certifications such as CISSP, CISM, CISA, CRISC, or CIPP. 

• Experience in healthcare, pharmacy, health insurance, or retail industries. 

• Experience with AI governance, model risk management, or emerging AI regulation. 

• Familiarity with SEC cybersecurity disclosure requirements and materiality assessment processes.