Senior Engineer, IT Governance and Compliance

Company Overview:

Cardinal Health, Inc. (NYSE: CAH) is a global healthcare services and products company. We provide customized solutions for hospitals, healthcare systems, pharmacies, ambulatory surgery centers, clinical laboratories, physician offices and patients in the home. We are a distributor of pharmaceuticals and specialty products; a global manufacturer and distributor of medical and laboratory products; an operator of nuclear pharmacies and manufacturing facilities;

and a provider of performance and data solutions. Working to be healthcare’s most trusted partner, our customer‑centric focus drives continuous improvement and leads to innovative solutions that improve the lives of people every day. With approximately 50,000 employees worldwide, Cardinal Health ranks among the top fifteen in the Fortune 500.

Information Technology oversees the effective development, delivery, and operation of computing and information services. This function anticipates, plans, and delivers Information Technology solutions and strategies that enable operations and drive business value.

Information Security and Risk develops, implements, and enforces security controls to protect the organization's technology assets from intentional or inadvertent modification, disclosure, or destruction. This job family develops system back‑up and disaster recovery plans, conducts incident responses, threat management, vulnerability scanning, virus management and intrusion detection as well as completes risk assessments.

IT Governance and Compliance function within the organization develops, enhances, and maintains security policies and IT compliance programs in alignment with regulatory, legal, and contractual requirements, while collaborating closely with key stakeholders to maintain a security and compliant technology environment.

We are committed to building a resilient, secure, and compliant digital ecosystem, and you will play a critical role in safeguarding our information and supporting our mission to improve the lives of people every day.

We are seeking a strategic and experienced Senior Engineer for IT Governance and Compliance
, who will be responsible for the design, implementation and continuous improvements of IT governance frameworks, controls, and compliance processes across the organization. This role will also serve as a senior technical and strategic resource ensuring IT operations, projects, and M&A activities are aligned with enterprise standards, regulatory requirements and industry’s best practices. In this role, you will have the opportunity to lead meaningful work, collaborate across functions, and help shape the future of our IT Governance and Compliance strategy.

This role is a leader position within the IT Governance and Compliance team and requires having an in-depth understanding of key privacy and security regulations within healthcare industry such as PCI DSS (Payment Card Industry Data Security Standard), HIPAA (Health Insurance Portability and Accountability Act), GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act), FDA (Food and Drug Administration)/GxP/CSV (Computer System Validation), DSCSA (Drug Supply Chain Security Act), as well as relevant governance frameworks to drive compliance to those regulatory requirements such as NIST, HITRUST, SOC 2, ISO, COBIT, ITIL, etc.,

while working with members of the Information Security and Risk Management team as well as stakeholders from Finance, Legal, Ethics & Compliance, Internal Audit and our various business segment leadership teams throughout the Cardinal Health enterprise.

• Lead the development, implementation and maintenance of the IT governance framework in alignment with industry standards.
• Partner with IT and business leaders to embed governance principles across IT eco‑system.
• Define and monitor key risk and performance indicators to ensure continuous compliance and operational excellence.
• Conduct periodic control assessments to confirm IT regulatory/compliance requirements are met (e.g., PCI‑DSS, HIPAA, DFARS/CMMC).
• Collaborate with solution owners and key…