Tim McKnight

Merck appointed Tim McKnight as Senior Vice President, IT Risk Management & Security and Chief Information Security Officer, announced in May 2026; day-level precision has not been established from available coverage.

Merck's security chief oversees one of the most consequential estates in pharma — the company's NotPetya losses in 2017 ran over a billion dollars and reshaped how the industry, and its insurers, price cyber risk. A veteran operator with prior Fortune-scale CISO tenures stepping in signals continuity of that board-level posture.

McKnight will oversee cybersecurity strategies and lead global IT risk management initiatives at Merck, CDO Magazine reports. CDO Magazine says those strategies are focused on strengthening the company's risk posture across its operations and on safeguarding sensitive data. In the role, McKnight is to work closely with cross-functional teams to enhance compliance measures and security protocols across the enterprise, according to CDO Magazine.

CDO Magazine reports that McKnight has more than 30 years of experience as a security professional across the private sector and government service. His most recent post was Chief Information Security Officer at UnitedHealth Group, the publication says. Before that, McKnight was responsible for driving the global security program at SAP, where he served as EVP and Chief Security Officer, CDO Magazine reports. According to CDO Magazine, he earlier held senior security leadership roles at Northrop Grumman, Fidelity Investments, GE and Thomson Reuters.

He said he would partner with teams across Merck to strengthen resilience and help accelerate innovation, CDO Magazine reports.

UnitedHealth Group appointed Tim McKnight as CISO, replacing Steven Martin following the Change Healthcare ransomware attack that impacted 100 million individuals. Martin was moving to the role of Chief Restoration Officer at UnitedHealth at the time of the announcement.

According to Cybersecurity Dive, Eric Hausman, who was UnitedHealth Group's VP of media relations at the time of the announcement, said adding McKnight would enable Martin to focus on what was, at the time of the announcement, his new role as chief restoration officer. Cybersecurity Dive reports that UnitedHealth Group declined to say whether the change in CISO came in response to the February ransomware attack.

Cybersecurity Dive reports that McKnight's security background goes back more than 30 years. The Record says McKnight worked for eight years as an FBI agent. Cybersecurity Dive reports that McKnight previously held security leadership roles at companies including Northrop Grumman, Fidelity Investments, GE and Thomson Reuters. At the time of the announcement, his most recent post had been EVP and CSO at SAP, and he served on multiple boards and in advisory roles, Cybersecurity Dive reported. The Record reports that McKnight served as board chairman for the Internet Security Alliance. According to The Record, he has also held various board positions within Tenable, Google, Amazon Web Services, Palo Alto Networks and IBM.

SecurityWeek reports that the CISO change came eight months after a ransomware attack on Change Healthcare, a UnitedHealth subsidiary.

Martin became CISO in May 2023, according to Cybersecurity Dive, which was nine months before the ransomware attack.