Director, Cyber Compliance (Information Security)

What Information Security and Risk contributes to Cardinal Health
Information Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure or destruction.

The Director, Cyber Compliance is responsible for establishing, leading, and continuously the cybersecurity compliance program to ensure adherence to regulatory, legal, and internal policy requirements. Reporting to the Vice President, Global Cybersecurity Governance, Risk & Compliance (GRC), this role drives the design and execution of compliance frameworks, assessments, and processes to support secure and compliant business operations. Furthermore, this leader oversees regulatory compliance management, internal and external compliance assessments, privacy and SOX compliance, and specialized regulatory domains such as FDA GxP. The Director serves as a partner and advisor to cybersecurity, IT, legal, audit, and business teams to ensure compliance obligations are understood, operationalized, and continuously monitored in alignment with enterprise risk and governance strategies.

Location - Fully remote, open to candidates based nationwide
 

Responsibilities

• Develop and lead a cybersecurity compliance program aligned with regulatory requirements, risk frameworks, and business objectives.
• Establish governance structures, processes, and accountability models to enable consistent execution of compliance activities across the organization.
• Serve as an advisor to cybersecurity and business leadership on regulatory requirements, compliance risks, and remediation priorities.
• Drive alignment between compliance initiatives and broader cybersecurity, risk, and governance strategies.
• Establish and maintain processes to ensure compliance with applicable cybersecurity regulations and standards (e.g., SOX, HIPAA, PCI, GDPR, CMMC).
• Monitor regulatory changes and emerging requirements to proactively adapt compliance programs and controls.
• Oversee compliance validation processes to ensure cybersecurity practices meet regulatory expectations.
• Provide leadership and oversight for regulatory audits, reviews, and inquiries.
• Enforce adherence to internal security policies, standards, and controls.
• Develop internal compliance assessment programs to evaluate systems, applications, and processes against defined security requirements.
• Identify compliance gaps and partner with stakeholders to define and execute remediation plans.
• Oversee continuous monitoring of compliance posture and alignment with internal governance frameworks.
• Oversee external compliance activities, including preparation of compliance evidence and responses to customer and third-party inquiries.
• Lead external compliance assessments and certifications (e.g., SOC 2, PCI, CMMC), enabling compliance readiness and successful outcomes.
• Coordinate with business and technology teams to support customer-driven compliance requirements and audits.
• Ensure consistency and accuracy of compliance responses and documentation across the organization.
• Oversee SOX IT General Controls (ITGC) compliance processes, including validation, monitoring, and remediation of control deficiencies.
• Lead privacy compliance efforts to ensure systems and data handling practices align with applicable privacy regulations (e.g., HIPAA, GDPR).
• Oversee specialized compliance programs such as FDA GxP, enabling adherence to regulatory requirements for systems supporting regulated products.
• Collaborate with legal and regulatory teams to interpret requirements and translate them into actionable controls and processes.
• Establish and maintain compliance readiness programs to ensure ongoing audit preparedness and regulatory alignment.
• Monitor compliance metrics and indicators to assess program effectiveness and identify emerging risks.
• Drive continuous improvement of compliance processes, tools, and methodologies to improve efficiency and scalability.
• Enable integration of compliance monitoring with broader cybersecurity risk management and reporting frameworks.
• Collaborate with cybersecurity, IT, legal, audit, and business teams to embed compliance requirements into enterprise processes and technology solutions.
• Serve as a liaison between compliance, risk, and operational teams to ensure alignment and coordination of activities.
• Provide guidance to project teams to ensure compliance requirements are met and incorporated into new initiatives and system implementations.
• Oversee internal and external audit activities by providing documentation, evidence, and subject matter expertise.
• Define and track compliance metrics and key risk indicators (KRIs) to measure program effectiveness and regulatory adherence.
• Provide regular reporting and insights to executive leadership on compliance posture, audit outcomes, and remediation progress.
• Establish standardized reporting frameworks to enable consistency, transparency, and accountability across compliance activities.
• Build and lead a high-performing cybersecurity compliance team with capabilities across regulatory compliance, assessments, and audit support.
• Develop team capabilities through coaching, training, and structured career development initiatives.
• Foster a culture of accountability, continuous improvement, and regulatory awareness across the organization.
• Ensure appropriate resourcing and capability alignment to support evolving compliance requirements.

Qualifications

• Ideally targeting individuals with 8+ years of experience in cybersecurity compliance, risk management, or information security, with a focus on regulatory compliance and audit.
• Strong expertise in cybersecurity compliance frameworks, regulatory requirements, and audit processes.
• Experience leading compliance programs, including internal and external assessments, audit management, and remediation efforts.
• Strong understanding of cybersecurity frameworks (e.g., NIST CSF, ISO 27001) and regulatory requirements (e.g., SOX, HIPAA, GDPR, PCI).
• Demonstrated ability to collaborate with cross-functional teams and influence stakeholders across the organization.
• Strong leadership, communication, and analytical skills.
• Experience in a people leader role overseeing cybersecurity compliance or GRC functions (preferred).
• Experience in highly regulated industries (e.g., aviation, financial services, healthcare, or government), preferred.
• Professional certifications such as CISSP, CISM, CRISC, CISA, or similar, preferred.
• Experience supporting specialized regulatory domains (e.g., FDA GxP, CMMC), preferred.

Anticipated Salary Range $137,400 - $232,320 USD

Bonus Eligible - Yes

Benefits: Cardinal Health offers a wide variety of benefits and programs to support health and well-being.

• Medical, dental and vision coverage

• Paid time off plan

• Health savings account (HSA)

• 401k savings plan

• Access to wages before pay day with myFlexPay

• Flexible spending accounts (FSAs)

• Short- and long-term disability coverage

• Work-Life resources

• Paid parental leave

• Healthy lifestyle programs

Application window anticipated to close: 09/30/2026 * if interested in opportunity, please submit application as soon as possible.

The salary range listed is an estimate. Pay at Cardinal Health is determined by multiple factors including, but not limited to, a candidate’s geographical location, relevant education, experience and skills and an evaluation of internal pay equity.

Candidates who are back-to-work, people with disabilities, without a college degree, and Veterans are encouraged to apply.

Cardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity/expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law.

To read and review this privacy notice click here