Sr Information Security Lead – Optum Tech – Remote

Explore opportunities with PharmScript, part of the Optum family of businesses. PharmScript is one of the nation’s leading pharmacies, partnering with long-term and post-acute care facilities to supply medications to thousands of residents and patients. Be part of our team that’s dedicated to delivering safe, accurate and timely medication to those who need it most. PharmScript is a place where you can thrive and contribute. Join us to start Caring. Connecting. Growing together.

 

PharmScript, one of the nation’s leading long term care pharmacies, partners with long-term and post- acute care facilities to supply medications to thousands of residents and patients.  Following our acquisition by Genoa Healthcare (an Optum Rx company) in 2024, Pharmscript is accelerating its cybersecurity transformation.

 

As we align with the Optum Enterprise Security & Resiliency Office (ESRO), we are expanding our security engineering capabilities to support both PharmScript-specific needs and the broader enterprise security initiatives.

 

This Senior Information Security Engineer will report directly to the CISO of PharmScript and act as a key security leader supporting the ongoing integration of PharmScript’s security operations into Optum’s enterprise-aligned model. This critical role will serve as the CISO’,’s technical deputy – responsible for the design, implementation, and oversight of core security functions including cloud security, incident response, vulnerability management, and identity & access management in a highly regulated healthcare-pharmacy environment (HIPAA, NIST, MARS-E).

 

You will work closely with security, IT, and business leaders across PharmScript, Genoa, and Optum to advance our security maturity while helping embed scalable enterprise security practices that align with ESRO’s mission to protect the organization, its data, and its people.

 

You’ll enjoy the flexibility to work remotely * from anywhere within the U.S. as you take on some tough challenges.

 

Primary Responsibilities:

Security Engineering & Architecture

• Own the technical roadmap for Microsoft Azure and Microsoft 365 security controls (Defender, Sentinel, Purview), SaaS SSO integrations (Entra ID, Cisco DUO MFA), and segmentation of our OneHealthCareID (OHID) customer portal
• Evaluate and implement tooling for vulnerability scanning, container/cloud posture management, and secrets management
• Partner with Development (CI/CD in Azure DevOps) to embed security into pipelines (SAST, DAST, IaC)
• Champion infrastructure as code and automation using Python and PowerShell

Threat Management & SOC Enablement

• Serve as tactical leader for the Security Operations Center, ensuring high fidelity alert triage, threat hunting, and purple team exercises
• Build and refine detection engineering for cloud and on prem environments, with an emphasis on Microsoft 365 threat vectors (Business Email Compromise, identity takeover)
• Coordinate tabletop exercises with the Pharmscript leadership, Business Operations and the IT organization

Vulnerability Management

• Direct the corporate vulnerability management program end to end: discovery, prioritization, remediation, and executive reporting
• Drive timely remediation SLAs across infrastructure, applications, and third party components; track progress through metrics dashboards

Governance, Risk & Compliance

• Lead annual NIST 800‑53 / HIPAA risk assessment and drive POAM remediation to closure
• Maintain policy exceptions, risk records, and metrics dashboards for C‑suite and Optum ESRO reporting

• Serve as audit liaison for SOC 2, HITRUST, and customer assessments

   

Identity & Access Management

• Standardize role‑based access across Azure, on‑prem AD, and SaaS applications; champion privileged‑access workflows
• Oversee federation and MFA strategy for internal staff and external pharmacy customers

Incident Preparedness & Response

• Act as technical lead for escalated incidents; refine playbooks for ransomware, ePHI exposure, and third‑party compromise
• Coordinate tabletop exercises with Genoa SOC and Optum Cyber Defense

Leadership & Delivery

• Mentor Security Engineers and SOC team members
• Translate complex risk into business language for pharmacy operations, legal, and finance stakeholders
• Manage security budget line items and vendor relationships

Competencies

• Relates well to constraints experienced by business partners and finds practical, win-win solutions
• Analyzes customer needs; ensures solutions meet business and security requirements
• Holds self and others accountable for meeting customer needs and expectations in a timely, professional manner
• Maintains high personal accountability; takes ownership of issues, develops effective remediation approaches, and drives for results
• Employs business acumen to develop appropriate solutions and solve problems – understands business risks and business objective
• Understands health care delivery and provider environments
• Able to translate business needs into information security requirements
• Ability to communicate technical security risks in a manner that resonates with business leaders 
• Able to establish and manage to a planned set of related activities with a focus on hitting deadlines

 

You’ll be rewarded and recognized for your performance in an environment that will challenge you and give you clear direction on what it takes to succeed in your role as well as provide development for other roles you may be interested in.

Required Qualifications:

• Bachelor’s degree in an IT related discipline or equivalent experience
• 3+ years of business experience in technology and/or technology/security audit
• 3+ years of experience with securing public cloud platforms (AWS, Azure, GCP)
• 1+ years of experience interacting with an executive audience
• 1+ years of experience with practical interpretation and application of policy and standards
• Experience presenting risk and remediation strategy to VP/C level leaders
• Experience with practical interpretation and application of policy and standards
• Working knowledge of HIPAA Security Rule, NIST 800 53, and privacy principles

 

Preferred Qualifications:

• Security certifications (CISSP, CCSP, Azure Security Engineer, HCISPP)
• Experience integrating with large to enterprise security programs
• Prior leadership of a small security engineering or GRC team
• Customer-facing leadership experience (e.g., support or client services)
• Hands on expertise securing Microsoft Azure and Microsoft 365 (IAM, networking, Defender, Sentinel, Purview)
• Proficiency in Python and PowerShell scripting for security automation, tooling and integration
• Proven track record running enterprise vulnerability management and remediation programs

 

*All employees working remotely will be required to adhere to UnitedHealth Group’s Telecommuter Policy

 

Pay is based on several factors including but not limited to local labor markets, education, work experience, certifications, etc. In addition to your salary, we offer benefits such as, a comprehensive benefits package, incentive and recognition programs, equity stock purchase and 401k contribution (all benefits are subject to eligibility requirements). No matter where or when you begin a career with us, you’ll find a far-reaching choice of benefits and incentives. The salary for this role will range from $89,900 to $160,600 annually based on full-time employment. We comply with all minimum wage laws as applicable.

 

Application Deadline: This will be posted for a minimum of 2 business days or until a sufficient candidate pool has been collected. Job posting may come down early due to volume of applicants.

 

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone-of every race, gender, sexuality, age, location and income-deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes – an enterprise priority reflected in our mission.

 

 

UnitedHealth Group is an Equal Employment Opportunity employer under applicable law and qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.

 

UnitedHealth Group is a drug – free workplace. Candidates are required to pass a drug test before beginning employment.