Senior Information Security Engineer Consultant

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.

The Information Security Analyst is responsible for supporting customer and contractual security obligations related to vulnerability management. This role serves as the liaison between security teams, application owners, infrastructure teams, and customer-facing stakeholders to ensure vulnerabilities are tracked, remediated within required service levels, and documented appropriately for internal governance and external customer reporting purposes.

The analyst will coordinate vulnerability remediation activities, monitor compliance with contractual and regulatory requirements, maintain accurate remediation evidence, support customer audits and questionnaires, and develop executive and customer-ready reporting that demonstrates effective management of security risks. 

Primary Responsibilities:

• Vulnerability Tracking & Governance
  • Track identified vulnerabilities from discovery through remediation and closure
  • Monitor remediation progress against internal policies, SLAs, customer contractual requirements, and regulatory obligations
  • Review vulnerability exception requests and ensure appropriate documentation and approvals are obtained
  • Escalate overdue vulnerabilities to appropriate management and stakeholders
  • Validate remediation status and supporting evidence prior to closure
  • Support remediation governance meetings and maintain action item tracking
• Customer Contractual Compliance
  • Interpret customer security requirements related to vulnerability management
  • Ensure remediation activities comply with contractual commitments and customer-specific timelines
  • Provide customers and internal account teams with vulnerability remediation status updates
  • Support customer security reviews, audits, assessments, and questionnaires
  • Maintain documentation supporting contractual security obligations
  • Coordinate responses to customer requests for remediation evidence and security reporting
• Documentation and Evidence Management
  • Maintain detailed remediation records and supporting evidence
  • Develop remediation summaries, executive reports, and customer-facing status reports
  • Ensure audit-ready documentation exists for vulnerability findings and corrective actions
  • Track historical remediation efforts and maintain records for compliance reviews
  • Create and update procedures, standards, and operational documentation
• Reporting & Metrics
  • Produce recurring vulnerability management reports and dashboards
  • Track SLA performance, aging vulnerabilities, remediation trends, and exceptions
  • Develop executive summaries highlighting high-risk findings and remediation status
  • Support Key Risk Indicator (KRI) and Key Performance Indicator (KPI) reporting
  • Analyze remediation trends and identify opportunities for process improvement
• Cross-Functional Collaboration
  • Partner with application, infrastructure, engineering, and operations teams
  • Coordinate remediation efforts across multiple business units
  • Engage with Security Operations, Vulnerability Management, Risk Management, Compliance, and customer account teams
  • Facilitate discussions regarding remediation priorities and risk reduction strategies
• Comply with all applicable Company policies, procedures, and business directives, changes including those relating to work location, team assignments, work schedules, and flexible work arrangements

Required Qualifications:

• Technical Security Knowledge
  • Vulnerability management lifecycle
  • CVSS scoring and severity assessment
  • Common Vulnerabilities and Exposures (CVE)
  • Security testing methodologies  
  • Vulnerability scanning
  • DAST
  • SAST
  • SCA
  • Penetration testing
  • Patch management processes
  • Risk management principles
  • Security controls and remediation strategies
• Vulnerability Management Platforms
  • Experience with one or more:
    • Tenable
    • Qualys
    • Rapid7
    • Microsoft Defender
    • Prisma Cloud
    • GitHub Advanced Security
    • ServiceNow Vulnerability Response
    • Other enterprise vulnerability management solutions
• Documentation & Reporting Skills
  • Solid technical writing
  • Creation of executive summaries
  • Audit evidence collection
  • Customer-facing reporting
  • Security questionnaire responses
  • Process documentation
  • Metrics and dashboard development
• Regulatory & Contractual Knowledge
  • Working knowledge of:
    • HITRUST
    • HIPAA
    • NIST Cybersecurity Framework
    • NIST 800-53
    • ISO 27001
    • SOC 2
    • Customer security contractual requirements
    • Third-party risk management practices
• Analytical Skills
  • Root cause analysis
  • Trend identification
  • Risk assessment
  • Data analysis
  • SLA tracking
  • Prioritization of remediation efforts
• Communication Skills
  • Customer-facing communication
  • Executive reporting
  • Stakeholder management
  • Meeting facilitation
  • Conflict resolution and escalation management
  • Ability to translate technical findings into business risk language

Preferred Qualifications:

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
• Certifications include:
  • Security+ 
  • CySA+
  • CISSP 
  • CISM 
  • GSEC 
  • GIAC Vulnerability Management (if available) 
  • CRISC 
• Experience:
  • 3+ years in Information Security, Vulnerability Management, Risk Management, Compliance, or Security Operations
  • Experience supporting customer security reviews and audit responses
  • Experience working with enterprise vulnerability remediation programs
  • Experience developing executive and customer reporting

Success Measures (First Year)

• A successful analyst in this role would:
  • Maintain vulnerability remediation compliance with contracted and policy-driven SLAs
  • Produce accurate customer remediation reports and audit evidence
  • Reduce aging and overdue vulnerabilities through effective tracking and escalation
  • Improve visibility into remediation activities through reporting and metrics
  • Successfully support customer audits, assessments, and contractual reviews
  • Establish reliable documentation processes that withstand internal and external audits

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone - of every race, gender, sexuality, age, location and income - deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.