Director, Cyber Risk Services (Information Security)

*What Information Security and Risk contributes to Cardinal Health*

Information Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure or destruction.

The *Director, Cyber Risk Services* is responsible for establishing, leading, and continuously improving the cybersecurity risk management program to identification, assessment, mitigation, and reporting of cyber risks. Reporting to the Vice President, Global Cybersecurity Governance, Risk & Compliance (GRC), this role drives the design and execution of risk management frameworks, methodologies, and supporting governance processes aligned with enterprise risk management (ERM), regulatory requirements, and business objectives.

Furthermore, this leader oversees core cyber risk capabilities including risk framework development, risk remediation oversight, and third-party risk management. It also plays a critical role in integrating cybersecurity risk into enterprise decision-making, enabling business-aligned risk insights, and driving adoption of consistent risk practices.

Location

- Fully remote, open to candidates based nationwide

Responsibilities

• Develop and lead the cybersecurity risk management strategy aligned with enterprise risk management frameworks, business objectives, and regulatory expectations.
• Collaborate with the VP of Global Cyber GRC and enterprise stakeholders to define risk management priorities, methodologies, and governance structures.
• Establish governance processes, roles, and accountability models to ensure consistent execution of cyber risk activities across the organization.
• Serve as an advisor to leadership on cybersecurity risk posture, emerging threats, and mitigation strategies.
• Define, standardize, and maintain cybersecurity risk management frameworks, methodologies, and taxonomies across the CISO Program.
• Ensure consistency in