Senior Information Security Analyst

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

The Senior Information Security Analyst will be part of the team responsible for leading or supporting the execution of Cybersecurity goals and objectives through the governance and management of Cybersecurity initiatives and resources and ensure security risks are managed and the organization complies with security requirements and regulations through active collaboration with our customers and stakeholders. 

• Engage directly with the appropriate Business or Technology Teams to ensure new products, services, applications, third party relationships have been assessed for controls and that any identified risks are remediated and closed in a timely manner.

• Lead new and recurring security risk assessments (e.g. HIPAA, PCI, etc.) and drive identified issues to a timely closure. Collaborate with other risk and compliance teams, such as Global Privacy, SOX, Internal Audit, Compliance & Ethics, to obtain a holistic risk posture.

• Establish security requirements for projects/programs (e.g. systems upgrade or implementation) and operations through engagement with Business and Technology teams.

• Proactively identify information security deficiencies or opportunities for improvement and facilitate development of pragmatic solutions.

• Work proactively with Business Information Security Officers (BISOs), Security Coordinators and Business and Technology teams to ensure security, IT risk and compliance is actively built into the organization objectives and procedures.

• Responsible for prioritization of work implementing cybersecurity initiatives and driving any identified issues to closure.

• Maintain a strong understanding of the Business Units’ Technology environment to manage the threat and risk landscape – application stacks, infrastructure components, and external facing footprint.

• Provide regular, timely reporting on the information security status across Technology Solution teams and provide regular metrics and reporting with a focus on continuous improvement.

• Collaborate with the relevant Business or Technology teams and act in a consultative way to help improve the security posture and adhere to security policies and expected controls.

• Facilitate the identification of high value assets to be monitored by Cybersecurity team.

• Communicate key deliverables and due dates to the Solution Teams and other technology and business stakeholders and service owners (application, infrastructure & business/SaaS vendor) with the goal to ensure compliance with Information Security standards, policies, and procedures.

• Provide escalation path for information security issues, incidents, and enquiries.

• Work with the Technology Team and Business Unit management team to determine acceptable levels of risk for the applicable Business Unit, report on variances, and propose/lead mitigation activities and drive them to closure.

• Partner with enterprise service teams to leverage capabilities and subject matter expertise.

• Acts as an Information Security subject matter expert on responsible area and endorse recommended solutions, providing thought leadership, coaching, and mentoring to other information security analysts as required.

Qualifications:

• Typically requires 7+ years of relative work experience.

• Bachelor’s degree or equivalent work experience.

• Experience in risk assessment, audit, and IT security assessments.

• Familiar with compliance regulations, IT, security frameworks and standards (i.e. NIST 800, ISO/IEC 27002, HIPAA, PCI, SOX, HITRUST).

• Proven ability to effectively lead multiple technical projects on-time and within budget.

• Strong ability to influence and negotiate, as well as to effectively prioritize and execute despite competing priorities and uncertainty.

• Supports Information Security Risk Assessments and contract reviews.

• Proven ability to effectively prioritize and execute tasks with competing priorities; strong influencing skills to work with various service owners.

• Excellent communication, analy