Senior Information Security Engineer Consultant

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.

The Information Security Analyst is responsible for supporting customer and contractual security obligations related to vulnerability management. This role serves as the liaison between security teams, application owners, infrastructure teams, and customer-facing stakeholders to ensure vulnerabilities are tracked, remediated within required service levels, and documented appropriately for internal governance and external customer reporting purposes.

The analyst will coordinate vulnerability remediation activities, monitor compliance with contractual and regulatory requirements, maintain accurate remediation evidence, support customer audits and questionnaires, and develop executive and customer-ready reporting that demonstrates effective management of security risks.

Primary Responsibilities

Vulnerability Tracking & Governance

• Track identified vulnerabilities from discovery through remediation and closure
• Monitor remediation progress against internal policies, SLAs, customer contractual requirements, and regulatory obligations
• Review vulnerability exception requests and ensure appropriate documentation and approvals are obtained
• Escalate overdue vulnerabilities to appropriate management and stakeholders
• Validate remediation status and supporting evidence prior to closure
• Support remediation governance meetings and maintain action item tracking

Customer Contractual Compliance

• Interpret customer security requirements related to vulnerability management
• Ensure remediation activities comply with contractual commitments and customer-specific timelines
• Provide customers and internal account teams with vulnerability remediation status updates
• Support customer security reviews, audits, assessments, and questionnaires
• Maintain documentation supporting contractual security obligations
• Coordinate responses to customer requests for remediation evidence and security reporting
• Documentation and Evidence Management
• Maintain detailed remediation records and supporting evidence
• Develop remediation summaries, executive reports, and customer-facing status reports
• Ensure audit-ready documentation exists for vulnerability findings and corrective actions
• Track historical remediation efforts and maintain records for compliance reviews
• Create and update procedures, standards, and operational documentation

Reporting & Metrics

• Produce recurring vulnerability management reports and dashboards
• Track SLA performance, aging vulnerabilities, remediation trends, and exceptions
• Develop executive summaries highlighting high-risk findings and remediation status
• Support Key Risk Indicator (KRI) and Key Performance Indicator (KPI) reporting
• Analyze remediation trends and identify opportunities for process improvement

Cross-Functional Collaboration

• Partner with application, infrastructure, engineering, and operations teams
• Coordinate remediation efforts across multiple business units
• Engage with Security Operations, Vulnerability Management, Risk Management, Compliance, and customer account teams
• Facilitate discussions regarding remediation priorities and risk reduction strategies
• Comply with all applicable Company policies, procedures, and business directives, changes including those relating to work location, team assignments, work schedules, and flexible work arrangements

Required Qualifications

Technical Security Knowledge

• Vulnerability management lifecycle
• CVSS scoring and severity assessment
• Common Vulnerabilities and Exposures (CVE)
• Security testing methodologies
• Vulnerability scanning

DAST

SAST

SCA

• Penetration testing
• Patch management processes
• Risk management principles
• Security controls and remediation strategies

Vulnerability Management Platforms

Experience with one or more

Tenable

Qualys

Rapid7

Microsoft Defender

Prisma Cloud

GitHub Advanced Security

ServiceNow Vulnerability Response

Other enterprise vulnerability management solutions

Documentation & Reporting Skills

• Solid technical writing
• Creation of executive summaries
• Audit evidence collection
• Customer-facing reporting
• Security questionnaire responses
• Process documentation
• Metrics and dashboard development

Regulatory & Contractual Knowledge

Working knowledge of

HITRUST

HIPAA

NIST Cybersecurity Framework

NIST 800-53

ISO 27001

SOC 2

Customer security contractual requirements

Third-party risk management practices

Analytical Skills

• Root cause analysis
• Trend identification
• Risk assessment
• Data analysis
• SLA tracking
• Prioritization of remediation efforts

Communication Skills

• Customer-facing communication
• Executive reporting
• Stakeholder management
• Meeting facilitation
• Conflict resolution and escalation management
• Ability to translate technical findings into business risk language

Preferred Qualifications

Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field

Certifications include

Security+

CySA+

CISSP

CISM

GSEC

GIAC Vulnerability Management (if available)

CRISC

Experience

• 3+ years in Information Security, Vulnerability Management, Risk Management, Compliance, or Security Operations
• Experience supporting customer security reviews and audit responses
• Experience working with enterprise vulnerability remediation programs

Experience developing executive and customer reporting

Success Measures (First Year)

A successful analyst in this role would

Maintain vulnerability remediation compliance with contracted and policy-driven SLAs

Produce accurate customer remediation reports and audit evidence

Reduce aging and overdue vulnerabilities through effective tracking and escalation

Improve visibility into remediation activities through reporting and metrics

Successfully support customer audits, assessments, and contractual reviews

Establish reliable documentation processes that withstand internal and external audits

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone - of every race, gender, sexuality, age, location and income - deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.