Principal Cybersecurity

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.

The Cybersecurity M&A Integration Auditor supports the successful integration of newly acquired companies by independently assessing progress against established cybersecurity integration requirements and milestones. This role evaluates whether cybersecurity controls, technologies, and processes have been fully implemented, validates supporting evidence, and identifies gaps where reported completion does not reflect the actual state of the environment. The analyst will work closely with cybersecurity, integration, business, and acquisition teams to provide clear, objective reporting on integration progress, risks, and areas requiring additional remediation.

Primary Responsibility:

• Comply with all applicable Company policies, procedures, and business directives, changes including those relating to work location, team assignments, work schedules, and flexible work arrangements

Required Qualifications:

• Working knowledge of cybersecurity controls and technologies - Broad understanding of common enterprise cybersecurity capabilities such as identity and access management, endpoint protection, vulnerability management, logging/SIEM, network security, data protection, cloud security, and security monitoring
• Solid communication and stakeholder management skills - Demonstrated ability to communicate clearly with technical teams, cybersecurity leadership, integration teams, and business stakeholders, including asking challenging follow-up questions when evidence or explanations are incomplete
• Ability to validate cybersecurity control implementation - Demonstrated ability to review artifacts, configurations, reports, screenshots, system outputs, procedures, and other evidence to determine whether a cybersecurity requirement or control has actually been implemented
• Solid critical thinking and professional skepticism - Demonstrated ability to recognize when a control or integration activity may be reported as complete but is only partially implemented, inconsistently deployed, improperly configured, or otherwise not operating as intended
• Solid documentation and reporting skills - Demonstrated ability to clearly document assessment results, evidence reviewed, identified gaps, risks, remediation needs, and progress in a manner that can be understood by both technical teams and management

Preferred Qualifications:

• Cybersecurity or audit certifications - Certifications such as CISA, CISSP, CRISC, CISM, Security+, or similar credentials demonstrating knowledge of cybersecurity, risk, or technology auditing
• Cybersecurity audit or assessment experience - Experience performing cybersecurity control assessments, internal audits, compliance reviews, risk assessments, or technology assurance activities within a large or complex organization
• Experience with major audit or consulting firms - Experience with a large professional services or audit organization such as Deloitte, PwC, EY, KPMG, or a comparable cybersecurity consulting organization
• Large enterprise experience - Experience evaluating cybersecurity controls across complex environments involving multiple business units, technology platforms, geographic locations, or regulatory requirements
• Knowledge of common cybersecurity frameworks - Familiarity with frameworks and standards such as NIST CSF, NIST 800-53, CIS Controls, ISO 27001, SOC 2, or similar cybersecurity control frameworks
• Mergers and acquisitions cybersecurity experience - Experience supporting cybersecurity activities associated with acquisitions, divestitures, joint ventures, or other corporate transactions
• Post-acquisition cybersecurity integration experience - Direct experience integrating acquired companies into enterprise cybersecurity technologies, standards, processes, or operating models
• Experience assessing M&A integration progress - Experience independently validating integration milestones, identifying incomplete implementation, challenging reported status, and providing assurance that integration requirements have been fully satisfied
• Experience working across cybersecurity domains during integrations - Exposure to multiple integration workstreams such as IAM, endpoint security, vulnerability management, SIEM/logging, network security, cloud security, data protection, and security operations
• Experience presenting integration risk to leadership - Ability to translate detailed technical findings into concise assessments of integration progress, residual risk, dependencies, and required actions for cybersecurity and business leadership

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone–of every race, gender, sexuality, age, location and income–deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes — an enterprise priority reflected in our mission.