Director Governance Risk and Compliance

Surescripts, LLC; Minneapolis (MN); Hybrid; USD 209,000 - 255,000; Full time

Job summary

Surescripts, LLC is seeking a strategic Director of Governance, Risk and Compliance to lead our GRC information security team and ensure regulatory and contractual obligations are met, while creating and maintaining policies and training programs.

You will oversee third‑party risk, business continuity, and security awareness initiatives, partnering with executives to strengthen risk management and incident response across the enterprise.

Qualifications

• Bachelor’s degree in a technical field, statistics, or risk management field or equivalent related experience.
• 10+ years of experience in related, progressive roles.
• Cyber security certification such as CISM, CGEIT, CRISC, CISA, CISSP.
• 5+ years of people management experience in roles showing progressive leadership.
• 5+ years of experience in information security risk management.
• Experience with AI and GRC Platforms Experience working with senior executives in a demanding and dynamic business environment with access to highly confidential and proprietary information.
• Skilled at effectively communicating with a broad range of audiences (executives, technical teams, non-technical business partners)
• Advanced skills in the areas of project management and implementing initiatives including proven experience with control frameworks and certifications such as NIST CSF, DirectTrust, HITRUST, SOC‑2, EHNAC, etc.
• Strong decision-making skills.
• Experience with educating the workforce on current risk/information security policies, standards, and procedures to ensure understanding.
• Ability to effectively communicate business risk as it relates to information security.
• Broad understanding of common risks and risk management strategies across many domains such as finance, technology, human resources, cybersecurity, competition, and environmental.
• Experience managing a risk program in the healthcare industry.

Responsibilities

• Provide strategic oversight of information security compliance initiatives to ensure rigorous alignment with all applicable information security regulatory standards and contractual obligations.
• Oversee and provide leadership direction for the Information Security GRC program, aligning with business objectives.
• Own the Information Security control framework and the annual assurance calendar —including scoping, evidence collection, control testing, auditor management, and remediation tracking to closure.
• Lead third‑party risk management for vendors and downstream partners handling PHI, including due diligence, BAA security terms, and ongoing monitoring; serve as the security escalation point for customer and partner security reviews, questionnaires, and contractual security obligations.
• Advance organizational cyber security awareness by developing and implementing tactical strategies that foster a risk‑intelligent culture.
• Lead and coordinate security awareness initiatives to consistently enhance cyber security knowledge and practices throughout the organization.
• Establish and govern a comprehensive risk management program—covering internal and external risk assessments to strengthen organizational resilience, compliance, and decision‑making.
• Provide leadership oversight to ensure continuous improvement and organizational compliance.
• Collaborate cross functionally with subject matter experts to document the risks and controls, measure the control effectiveness and report the findings through key risk and performance indicators.
• Provide oversight to ensure that business continuity plans are reviewed annually.
• Collaborate with cross-functional teams across Surescripts to develop, test, and validate contingency plans for critical business operations, thereby strengthening organizational resilience and preparedness.
• Develop, maintain and communicate the risk appetite framework and corresponding model(s) of risk tolerance, including the design process and protocol for routine monitoring of risk metrics against limits and escalation.
• Build and lead the Information Security GRC team — hiring, developing, and retaining analysts across policy, risk assessment, control testing, and audit response.
• Foster a culture of continuous learning and ensure institutional knowledge (control rationale, audit history, regulatory and customer commitments) is documented and transferable rather than person‑dependent.

Skills

Leadership

Risk management

Information security

Regulatory compliance

Vendor risk management

Auditing

Control frameworks

Project management

Communication

Education

Bachelor’s degree in a technical field, statistics, or risk management field

Tools

CISM

CGEIT

CRISC

CISA

CISSP

Job description

Job Summary

The Director of Governance, Risk and Compliance provides strategic oversight of the Governance Risk and Compliance (GRC) information security team to ensure compliance with regulatory and contractual requirements. This role is responsible for creating, maintaining, and training on all Information Security Policy and Standards. This role leads a team that provides project risk assessment, project security subject matter expertise, and third‑party security risk assessment. This role also oversees all business continuity and crisis management efforts across the enterprise along with overseeing and managing the information security training and awareness program.

Responsibilities

• Provide strategic oversight of information security compliance initiatives to ensure rigorous alignment with all applicable information security regulatory standards and contractual obligations.
• Oversee and provide leadership direction for the Information Security GRC program, aligning with business objectives.
• Own the Information Security control framework and the annual assurance calendar —including scoping, evidence collection, control testing, auditor management, and remediation tracking to closure.
• Lead third‑party risk management for vendors and downstream partners handling PHI, including due diligence, BAA security terms, and ongoing monitoring; serve as the security escalation point for customer and partner security reviews, questionnaires, and contractual security obligations.
• Advance organizational cyber security awareness by developing and implementing tactical strategies that foster a risk‑intelligent culture.
• Lead and coordinate security awareness initiatives to consistently enhance cyber security knowledge and practices throughout the organization.
• Establish and govern a comprehensive risk management program—covering internal and external risk assessments to strengthen organizational resilience, compliance, and decision‑making.
• Provide leadership oversight to ensure continuous improvement and organizational compliance.
• Collaborate cross functionally with subject matter experts to document the risks and controls, measure the control effectiveness and report the findings through key risk and performance indicators.
• Provide oversight to ensure that business continuity plans are reviewed annually.
• Collaborate with cross-functional teams across Surescripts to develop, test, and validate contingency plans for critical business operations, thereby strengthening organizational resilience and preparedness.
• Develop, maintain and communicate the risk appetite framework and corresponding model(s) of risk tolerance, including the design process and protocol for routine monitoring of risk metrics against limits and escalation.
• Build and lead the Information Security GRC team — hiring, developing, and retaining analysts across policy, risk assessment, control testing, and audit response.
• Foster a culture of continuous learning and ensure institutional knowledge (control rationale, audit history, regulatory and customer commitments) is documented and transferable rather than person‑dependent.

Basic Requirements

• Bachelor’s degree in a technical field, statistics, or risk management field or equivalent related experience.
• 10+ years of experience in related, progressive roles.
• Cyber security certification such as CISM, CGEIT, CRISC, CISA, CISSP.
• 5+ years of people management experience in roles showing progressive leadership.
• 5+ years of experience in information security risk management.
• Experience with AI and GRC Platforms Experience working with senior executives in a demanding and dynamic business environment with access to highly confidential and proprietary information.
• Skilled at effectively communicating with a broad range of audiences (executives, technical teams, non-technical business partners)
• Advanced skills in the areas of project management and implementing initiatives including proven experience with control frameworks and certifications such as NIST CSF, DirectTrust, HITRUST, SOC‑2, EHNAC, etc.
• Strong decision-making skills.
• Experience with educating the workforce on current risk/information security policies, standards, and procedures to ensure understanding.
• Ability to effectively communicate business risk as it relates to information security.
• Broad understanding of common risks and risk management strategies across many domains such as finance, technology, human resources, cybersecurity, competition, and environmental.
• Experience managing a risk program in the healthcare industry.

Preferred Qualifications

• Experience with Business Continuity Planning.
• Ability to guide governance, risk, and compliance decisions related to AI‑enabled technologies, including oversight of risk assessments, controls, and policy alignment.
• Up‑to‑date understanding of a wide range of incident responses, system configuration, vulnerability management and hardening guidelines.
• One or more AI cyber security certifications such as AAISM, AAIA, AAIR.
• Demonstrated ability to lead AI risk assessments, control design, and policy/standard alignment.

Keywords

risk, SOC‑2, DirectTrust, HITRUST, crisis management, GRC Surescripts embraces flexibility through its Flexible Hybrid Work model for most positions. This model allows employees to work virtually while still utilizing our offices as collaboration centers. With alignment and agreement from your leadership, you can come and go from the office as needed.

Work Requirements

To be considered for employment, applicants must have a valid U.S. work authorization allowing work without restrictions with Surecripts in the U.S. At this time, we are unable to provide support or provide sponsorship for immigration benefits such as work visas. Additionally, we do not participate in academic training programs or work‑study programs through an academic institution that require employer endorsement of F‑1/CPT or F‑1/STEM.

What You’re Like

You’re technical. Analytical. Imaginative. Maybe you’re building your own crypto‑mining rig—or not. Either way, your mind works to anticipate vulnerabilities and protect the company and its information against those vulnerabilities. You do the right thing because it’s the right thing without seeking to point fingers or brag. And of course, you’re always willing to keep learning.

What We’re Like

We’re a team of friendly folks who do serious work. Our best work is done by rising to the occasion under stress, but we keep each other cool under pressure. We’re a tight team but we also look for ways to partner across the business. Our style is casual and laid back, but we shoulder our responsibility to protect patient data from sophisticated adversaries, which sometimes means delivering a difficult truth.

What the Work is Like

Our challenge is to protect our customers’ data and our company. This requires anomaly analysis, risk reviews, pen testing of our controls, red‑testing and tabletop, policy and procedure work, documentation, and audits. We also engineer and maintain our security products and tools. It’s not always a typical 9‑to‑5 gig, of course, but then again, you work in information security, so you already know that.

Base Pay and Benefits

The base pay range for this position is $208,550 - $254,850 per year. Your base pay may vary within or outside of this range depending on a number of factors, including (but not limited to) your qualifications, skills, experience, and location.

• comprehensive healthcare (including infertility coverage)
• generous paid time off including paid childbirth and parental leave and mental health days
• pet insurance
• 401(k) with company match and immediate vesting

Benefits

Benefits include, but are not limited to, comprehensive healthcare (including infertility coverage), generous paid time off including paid childbirth and parental leave and mental health days, pet insurance, and 401(k) with company match and immediate vesting.

Physical and Mental Requirements

While performing duties of this job, an employee may be required to perform any, or all of the following: attend meetings in and out of the office, travel, communicate effectively (both orally and in writing), and be able to effectively use computers and other electronic and standard office equipment with, or without, a reasonable accommodation. Additionally, this job requires certain mental demands, including the ability to use judgement, withstand moderate amounts of stress and maintain attention to detail with, or without, a reasonable accommodation.

Work Environment

Surescripts embraces flexibility through its Flexible Hybrid Work model for most positions. This model allows employees to work virtually while still utilizing our offices as collaboration centers. With alignment and agreement from your leadership, you can come and go from the office as needed.

Equal Employment Opportunity

Surescripts is proud to be an Equal Employment Opportunity and affirmative action employer. We do not discriminate on the basis of race, color, religion, age, national origin, ancestry, disability, medical condition, marital status, pregnancy, genetic information, gender, sexual orientation, parental status, gender identity, gender expression, veteran status, or any other status protected under federal, state, or local law.

Additional Information

To learn more, review the Keep You and Yours Healthy, Balancing Work and Life, and Where Talent Takes Shape links under the Better Benefits. Better Work. Better Life section of our careers site. Surescripts is proud to be an Equal Employment Opportunity and affirmative action employer. Surescripts serves the nation through simpler, trusted health intelligence sharing, in order to increase patient safety, lower costs and ensure quality care. We deliver insights at critical points of care for better decisions — from streamlining prior authorization to delivering comprehensive medication histories to facilitating messages between providers.

Reasonable Accommodation

We recognize the importance of fostering an environment that leverages the unique contributions of all individuals and we are committed to providing reasonable accommodations to every applicant. If you need a reasonable accommodation for any portion of the employment process, please contact us at [e-mail].

Regulatory Compliance

Know Your Rights: Workplace Discrimination is Illegal | Pay Transparency Surescripts participates in E-Verify. Details in English and Spanish. Right to Work Statement in English and Spanish.