Director, GRC & Information Security — Hybrid Leader

Surescripts; Minneapolis (MN); Hybrid; USD 209,000 - 255,000; Full time

Benefits offered by this job

Comprehensive healthcare

Infertility coverage

Paid time off

Parental leave

Mental health days

Pet insurance

401(k) matching

Job summary

Surescripts seeks a Director of Governance, Risk and Compliance to lead the GRC information security program and ensure compliance with regulatory and contractual requirements. You will own policy, standards, risk assessments, and training across the enterprise.

You will build a risk-aware culture, manage third-party security, and oversee business continuity while partnering with executives to align security with business objectives in a flexible hybrid work environment.

Qualifications

• Bachelor’s degree in a technical field, statistics, or risk management field or equivalent related experience.
• 10+ years of experience in related, progressive roles.
• Cyber security certification such as CISM, CGEIT, CRISC, CISA, CISSP.
• 5+ years of people management experience in roles showing progressive leadership.
• 5+ years of experience in information security risk management.

Responsibilities

• Provide strategic oversight of information security compliance initiatives to ensure rigorous alignment with all applicable information security regulatory standards and contractual obligations.
• Oversee and provide leadership direction for the Information Security GRC program, aligning with business objectives.
• Own the Information Security control framework and the annual assurance calendar —including scoping, evidence collection, control testing, auditor management, and remediation tracking to closure.
• Lead third-party risk management for vendors and downstream partners handling PHI, including due diligence, BAA security terms, and ongoing monitoring; serve as the security escalation point for customer and partner security reviews, questionnaires, and contractual security obligations.
• Advance organizational cyber security awareness by developing and implementing tactical strategies that foster a risk-intelligent culture.

Skills

Governance risk and compliance

Information security risk management

Security certifications (CISM/CGEIT/CR

Education

Bachelor’s degree in technical field / risk management

Tools

GRC platforms

Job description

Surescripts seeks a Director of Governance, Risk and Compliance to lead the GRC information security program and ensure compliance with regulatory and contractual requirements. You will own policy, standards, risk assessments, and training across the enterprise.

You will build a risk-aware culture, manage third-party security, and oversee business continuity while partnering with executives to align security with business objectives in a flexible hybrid work environment.