Director, Cyber Compliance (Information Security)

What Information Security and Risk contributes to Cardinal Health Information Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure or destruction. The Director, Cyber Compliance is responsible for establishing, leading, and continuously the cybersecurity compliance program to ensure adherence to regulatory, legal, and internal policy requirements. Reporting to the Vice President, Global Cybersecurity Governance, Risk & Compliance (GRC), this role drives the design and execution of compliance frameworks, assessments, and processes to support secure and compliant business operations. Furthermore, this leader oversees regulatory compliance management, internal and external compliance assessments, privacy and SOX compliance, and specialized regulatory domains such as FDA GxP. The Director serves as a partner and advisor to cybersecurity, IT, legal, audit, and business teams to ensure compliance obligations are understood, operationalized, and continuously monitored in alignment with enterprise risk and governance strategies. Location - Fully remote, open to candidates based nationwide   Responsibilities Develop and lead a cybersecurity compliance program aligned with regulatory requirements, risk frameworks, and business objectives. Establish governance structures, processes, and accountability models to enable consistent execution of compliance activities across the organization. Serve as an advisor to cybersecurity and business leadership on regulatory requirements, compliance risks, and remediation priorities. Drive alignment between compliance initiatives and broader cybersecurity, risk, and governance strategies. Establish and maintain processes to ensure compliance with applicable cybersecurity regulations and standards (e.g., SOX, HIPAA, PCI, GDPR, CMMC). Monitor regulatory changes and emerging requirements to proactively adapt compliance programs and controls. Oversee compliance validation processes to ensure cybersecurity practices meet regulatory expectations. Provide leadership and oversight for regulatory audits, reviews, and inquiries. Enforce adherence to internal security policies, standards, and controls. Develop internal compliance assessment programs to evaluate systems, applications, and processes against defined security requirements. Identify compliance gaps and partner with stakeholders to define and execute remediation plans. Oversee continuous monitoring of compliance posture and alignment with internal governance frameworks. Oversee external compliance activities, including preparation of compliance evidence and responses to customer and third-party inquiries. Lead external compliance assessments and certifications (e.g., SOC 2, PCI, CMMC), enabling compliance readiness and successful outcomes. Coordinate with business and technology teams to support customer-driven compliance requirements and audits. Ensure consistency and accuracy of compliance responses and documentation across the organization. Oversee SOX IT General Controls (ITGC) compliance processes, including validation, monitoring, and remediation of control deficiencies. Lead privacy compliance efforts to ensure systems and data handling practices align with applicable privacy regulations (e.g., HIPAA, GDPR). Oversee specialized compliance programs such as FDA GxP, enabling adherence to regulatory requirements for systems supporting regulated products. Collaborate with legal and regulatory teams to interpret requirements and translate them into actionable controls and processes. Establish and maintain compliance readiness programs to ensure ongoing audit preparedness and regulatory alignment. Monitor compliance metrics and indicators to assess program effectiveness and identify emerging risks. Drive continuous improvement of compliance processes, tools, and methodologies to improve efficiency and scalability. Enable