Information Security Officer - Remote

For those who want to invent the future of health care, here's your opportunity. We're going beyond basic care to health programs integrated across the entire continuum of care. Join us in making healthcare work better for everyone through people-led, responsible AI while Caring. Connecting. Growing together.

The Information Security Officer serves as a Subject Matter Expert (SME) for cybersecurity across Optum Serve. Responsibilities include ensuring all information security needs are implemented promptly, requiring collaboration with the Infrastructure and Operations team, ESRO, and Optum Serve Information Security team. This role ensures alignment with ESRO standards and government frameworks, such as NIST SP 800-37, NIST SP 800-53, NIST SP 800-171, and FedRAMP to obtain and maintain ATOs, FedRAMP authorizations, and CMMC Level 2 certifications. The candidate will manage security controls to safeguard Optum Serve's networks and systems.

The Information Security Officer will address all government and client security inquiries related to security and compliance. This position entails coordinating, developing, updating, and maintaining security documentation for CMMC Level 2 Certification, including the ATO package (SSP, CP, CMP, IRP, POAM, etc.) and its annual updates. The role also involves managing and reporting system risks and vulnerabilities, coordinating third-party audits, and overseeing annual penetration tests.

You'll enjoy the flexibility to work remotely * from anywhere within the U.S. as you take on some tough challenges.

Primary Responsibilities:

• Serves as a Subject Matter Expert (SME) for information security governance, risk management, and compliance in accordance with the NIST Risk Management Framework
• Liaise with Business and IT Groups in security compliance, design, planning, implementation, and continuous monitoring phases of IT and business-related projects
• Create and maintain new and existing standard operating procedures, work with multi-functional team members to maintain high-quality work standards
• Solid understanding of cloud computing models, management of cloud-based environments, and cloud providers
• Solid understanding of security architecture, operating systems, databases, networks, applications, and security tools
• Solid knowledge and experience with regulatory frameworks such as NIST 800-53, NIST 800-171, CMMC, FedRAMP and DoD Risk Management Framework (RMF)
• Solid knowledge and experience with security control compliance/implementation with Security Technical Implementation Guides (STIGs), CMMC certification, and the ATO processes to include Plan of Action and Milestones (POAM) management
• Develop and maintain security documentation to include but not limited to System Security Plan (SSP), Contingency Plans, Configuration Management Plan, and Disaster Recovery Plan