Director, GRC & Information Security Strategy

Surescripts; United States; Hybrid; USD 209,000 - 255,000; Full time

Job summary

Surescripts seeks an experienced Director of Governance, Risk and Compliance to oversee the GRC information security team and ensure regulatory and contractual compliance. You will create, maintain and train on information security policy standards, manage risk assessments, vendor security, and business continuity across the enterprise.

You will lead cross‑functional teams, report on risk metrics, and collaborate with executives to align security with business objectives.

Qualifications

• Bachelor’s degree in a technical, statistics, risk management field or equivalent.
• 10+ years in progressive information security roles with governance focus.
• Cyber security certifications (CISM, CGEIT, CRISC, CISA, CISSP).
• 5+ years of people management in security leadership.
• 5+ years of information security risk management.
• Experience with AI and GRC platforms.
• Ability to interact with senior executives and maintain confidentiality.
• Strong knowledge of control frameworks (NIST CSF, SOC-2, HITRUST, etc.).
• Experience educating workforce on security policies and risk concepts.
• Broad understanding of risks across multiple domains including healthcare.

Responsibilities

• Provide strategic oversight of information security compliance initiatives.
• Lead the Information Security GRC program and alignment with business goals.
• Own the information security control framework and assurance calendar.
• Lead third‑party risk management for vendors handling PHI.
• Advance cyber security awareness across the organization.
• Establish and govern a comprehensive risk management program.
• Provide leadership to ensure continuous improvement and compliance.
• Document risks, controls, and report via KRIs and KPIs.
• Oversee business continuity plans and contingency testing.
• Develop risk appetite frameworks and monitoring mechanisms.
• Build and lead the Information Security GRC team.

Skills

Governance

Regulatory

Leadership

Executive comms

Risk mgmt

Healthcare security

Education

Bachelor’s degree in technical field

Cyber security certifications (CISM, CGEIT, CRISC, CISA, CISSP)

Tools

GRC Platforms

NIST CSF

SOC 2

DirectTrust

Job description

Surescripts seeks an experienced Director of Governance, Risk and Compliance to oversee the GRC information security team and ensure regulatory and contractual compliance. You will create, maintain and train on information security policy standards, manage risk assessments, vendor security, and business continuity across the enterprise.

You will lead cross‑functional teams, report on risk metrics, and collaborate with executives to align security with business objectives.