Director Information Security Risk Management

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together. The Director, XXX Technology and Cyber Governance is responsible for leading the GRC offshore teams for Technology, Cyber and AI Governance Risk and Control. The team drives the implementation, and continuous improvement of governance routines that ensure effective adherence to technology and cybersecurity standards. This role plays a critical part in shaping the enterprise technology risk profile and embedding sustainable, risk-based governance practices that drive accountability, transparency, and informed decision-making across technology organizations. Success in this role requires not only deep audit and risk expertise but also the ability to architect governance operating models, integrate risk into business processes, and influence senior stakeholders to adopt consistent and scalable risk management practices. Scope The role requires ongoing engagement with policy and standard owners, executive leadership, and technology stakeholders to establish robust governance routines that translate policy requirements into measurable, enforceable, and sustainable practices. The Director will lead the offshore (India, Ireland and Philippines) GRC Technology and Cybersecurity teams to define the governance pillars including risk assessments, metrics, and executive reporting, governance routines that ensure technology team alignment to enterprise risk appetite and regulatory expectations. The role also partners with suppliers, business owners, control owners, and risk teams to identify gaps, validate remediation, and assess control effectiveness, while driving improvements in governance maturity and operational resilience.

Lead a team that supports the definition and implementation of a comprehensive technology and cybersecurity and AI governance framework, including oversight routines, risk reporting structures, and escalation pathways Design and collaborate with Technology and Cybersecurity teams to operationalize risk governance routines that integrate into day-to-day technology processes (e.g., SDLC, cloud deployments, third-party onboarding) As part of governance, collaborate with Technology and Cybersecurity teams to ensure they define Key Risk Indicators (KRIs), Key Control Indicators (KCIs), and performance metrics, including thresholds aligned to risk appetite that support the GRC metrics framework Lead risk profiling and aggregation activities, connecting control effectiveness, threat landscape, and business impact into a clear enterprise risk view Evaluate and challenge governance processes to ensure consistency, scalability, automation, and sustainability Drive standardization of governance practices across disparate technology teams and domains Assess effectiveness of preventive vs. detective controls, continuous monitoring capabilities, and automated controls Influence leadership to strengthen risk ownership, accountability, and decision-making discipline Ensure governance routines satisfy regulatory, audit, and industry framework expectations Comply with the terms and conditions of the employment contract, company policies and procedures, and any and all directives (such as, but not limited to, transfer and/or re-assignment to different work locations, change in teams and/or work shifts, policies in regards to flexibility of work benefits and/or work environment, alternative work arrangements, and other decisions that