Associate Vice President of Platform Security

CVS Health is seeking a polished and experienced security leader to serve as Associate Vice President of Platform Security, responsible for defining and executing the enterprise strategy for securing cloud, container, and AI platforms across CVS Health's technology estate.

Key Responsibilities:

• Define and own the enterprise platform security strategy, roadmap, and policy framework for cloud, container, and AI security, aligned with CVS Health's business objectives, technology strategy, and regulatory obligations.
• Establish a unified technical standards and architecture approach across cloud, container, and AI platforms, ensuring security controls are built into platform design and operational execution.
• Stand up and mature the AI Security operating model as a first-class enterprise capability supporting safe AI and GenAI adoption across the enterprise.
• Serve as a subject matter expert and trusted advisor to senior technology, security, and business executives on emerging platform security risks, cloud-native attack trends, AI threats, and industry best practices.
• Drive continuous improvement across the platform security program through risk-based prioritization, measurable KPIs, executive reporting, benchmarking, and innovation.

Cloud, Container & Platform Security Engineering:

• Own the strategy, architecture, and operational standards for securing enterprise cloud environments, including cloud posture management, policy-as-code, identity and access guardrails, vulnerability exposure reduction, and automated remediation workflows.
• Define and govern container and Kubernetes security across cloud and on-premises container platforms, including image scanning, workload protection, runtime controls, configuration standards, vulnerability management, and platform coverage objectives.
• Promote preventive guardrails, policy enforcement, infrastructure-as-code controls, and self-service remediation patterns that reduce risk while preserving engineering velocity.
• Influence the platform security tooling portfolio, including CSPM, CNAPP, container security, posture management, AI security, and related integrations.

AI Security Strategy, Architecture & Controls:

• Establish and scale a dedicated AI Security function with clear accountability, sustained governance, and defined responsibilities across AI governance, platform security, model security, agentic security, incident readiness, and risk reporting.
• Define and maintain enterprise AI security standards, including requirements for AI gateways, model gateways, prompt and response guardrails, model review, model inventory, AI use case risk classification, and controls for high-risk AI use cases.
• Own security requirements for AI/Agent Gateway capabilities, including identity propagation, tool and service brokering, prompt-injection defenses, default-deny mediation, data protection, auditability, traffic and cost controls, runtime governance, and agentic runtime protections.
• Drive controls for agent identity, authentication, authorization, registry, tool governance, long-running agent activity, non-human identity exposure, session revocation, kill switches, human-in-the-loop gates, and runtime behavioral monitoring.

Governance & Compliance:

• Define and maintain platform security policies, standards, reference architectures, and operational procedures for cloud, container, infrastructure, and AI security domains.
• Ensure security controls align with applicable regulatory frameworks and industry standards, including HIPAA, PCI-DSS, ISO/IEC 42001, NIST AI RMF, NIST CSF, MITRE ATLAS, OWASP LLM/Agentic guidance, and cloud security best practices.
• Provide executive-level reporting and governance dashboards that communicate program health, control coverage, security posture, remediation progress, residual risk, and decisions requiring leadership sponsorship.

Leadership & Collaboration:

• Build, lead, and develop a high-performing organization of cloud security, container security, infrastructure security, AI security, and distinguished engineering leaders.
• Lead through direct and matrixed influence across Cloud Security Services, Infrastructure Security, AI Security, Application Security, IAM, Cyber Delivery, Cyber Defense, Data Protection, Developer Experience, Enterprise Architecture, and business technology teams.
• Partner with the Vice President of Security Engineering and Platforms, peer AVPs, Executive Directors, and enterprise technology leaders to align platform security priorities with broader SecEng strategy, OKRs, investment decisions, and enterprise delivery commitments.

Key Performance Indicators (KPIs):

• Cloud Security Posture: Reduction in critical, high, and medium cloud risks; percentage of cloud environments covered by posture management and policy enforcement controls.
• Container Security Coverage: Percentage of cloud and on-premises container platforms covered by container security tooling, image scanning, runtime protection, and vulnerability remediation workflows.
• Remediation SLA Performance: Mean time to remediate critical and high platform security findings, including cloud misconfigurations, container vulnerabilities, exposed workloads, and AI platform risks.
• AI Security Operating Model Maturity: Progress against the AI Security operating model, dedicated staffing plan, governance cadence, standards publication, and sustained control ownership.
• AI Gateway & Guardrail Adoption: Coverage of enterprise AI and agentic traffic through approved AI gateways, model gateways, prompt/response guardrails, content filtering, logging, and runtime governance controls.
• AI Visibility & Inventory: Percentage of AI platforms, models, agents, endpoints, and SaaS AI usage visible through approved inventory, monitoring, and reporting capabilities.
• Unauthorized Model & Tool Use: Reduction in unauthorized AI models, unapproved connectors, unmanaged MCP/tool usage, and AI services operating outside approved governance and security controls.
• Compliance & Audit Readiness: Conformance to ISO/IEC 42001, NIST AI RMF, HIPAA, PCI-DSS, and internal security standards, targeting zero critical audit findings related to platform and AI security controls.
• Executive Risk Transparency: Timely delivery of executive reporting, decision requests, risk trends, and escalations for cloud, container, and AI security posture.
• Roadmap Delivery: On-time delivery of strategic platform security initiatives, including cloud and container posture improvements, AI Security capability buildout, AI gateway deployment, and risk-based automation milestones.