Director of Cybersecurity Governance, Risk and Compliance

University of Texas at Austin; United States; Presencial; USD 153.000 - 187.000; Jornada completa

Descripción de la vacante

University of Texas at Austin's Dell Medical School seeks a Director of Cybersecurity Governance, Risk and Compliance to shape and mature its GRC program across clinical, research, and academic environments, as UT moves toward hospital operations in 2030.

Reporting to the Deputy CISO, you will lead HIPAA security risk analyses, third‑party risk, incident response coordination, policy development, and executive reporting, partnering with legal, privacy, and enterprise security teams.

Formación

• Master’s degree in IT, cybersecurity, health informatics, or related field.
• Minimum five years in progressive leadership roles in information security governance or GRC.
• Minimum eight years in healthcare, banking, defense, or high-security environments.
• CISSP or CISM certification

Responsabilidades

• Lead GRC strategy and program maturity for Dell Medical School.
• Build and lead a team of GRC analysts and security compliance professionals.
• Provide executive reporting on risk posture and program metrics.
• Oversee HIPAA risk analyses and remediation coordination.
• Govern policy, third‑party risk, incident response, and business continuity.
• Collaborate with legal, privacy, audit, and enterprise security stakeholders.

Conocimientos

Leadership

Governance & risk management

Cybersecurity

Healthcare security

Educación

Master’s degree in Information Technology, Cybersecurity, Health Informatics, or a related field

Descripción del empleo

Job Posting Title:

Director of Cybersecurity Governance, Risk and Compliance

Hiring Department:

Dell Medical School

Position Open To:

All Applicants

Weekly Scheduled Hours:

40

FLSA Status:

Exempt from FLSA

Earliest Start Date:

Immediately

Position Duration:

Expected to Continue

Location:

UT MAIN CAMPUS

Job Details:

General Notes

Dell Medical School is seeking an experienced cybersecurity governance, risk and compliance leader to help shape and mature the cybersecurity GRC program supporting its growing clinical, academic, and research mission and path toward full hospital operations in 2030.

The Director of Cybersecurity Governance, Risk and Compliance leads the information security GRC program for UT Medicine and Dell Medical School. Reporting to the Deputy CISO, this role builds and operates a mature GRC function that enables the organization to assess, manage, and mitigate cybersecurity risk across a complex clinical, academic, and research environment.

Dell Medical School operates within UT Austin’s established enterprise security program and inherits a baseline of enterprise policies, procedures, and tooling. Within this federated model, the Director focuses on cybersecurity risks and governance requirements specific to Dell Medical School’s healthcare delivery, clinical research, regulatory compliance, and evolving operational environment.

This is a program-building leadership opportunity with responsibility for GRC strategy, cybersecurity risk management, healthcare- and research-specific security governance, third-party risk, incident response coordination, business continuity and disaster recovery, and executive-level reporting. The role partners closely with technology, clinical, research, legal, privacy, audit, compliance, and UT Austin information security stakeholders as Dell Medical School continues to build capabilities that can scale with its future hospital operations.

Purpose

The Director of Cybersecurity Governance, Risk and Compliance provides strategic leadership for Dell Medical School’s information security governance, risk management, and compliance program. Reporting to the Deputy CISO, the Director leads cybersecurity risk and governance activities across Dell Medical School’s clinical, academic, research, and administrative environments while building capabilities that support continued organizational growth toward full hospital operations in 2030.

Responsibilities

GRC Program Leadership and Strategy

• Develop and execute the Dell Medical School GRC strategy aligned with organizational objectives, regulatory requirements, and the 2030 hospital opening.
• Build and lead a team of GRC analysts and security compliance professionals, providing ongoing coaching and career development.
• Deliver executive-level reporting on risk posture, compliance status, and program maturity to the Deputy CISO and governance bodies.
• Develop a GRC metrics and KPI framework measuring program effectiveness, employee compliance behavior, and security posture improvement over time.
• Evaluate cybersecurity insurance options and risk-transfer mechanisms as part of the organization’s residual risk strategy.
• Coordinate with internal audit, legal, privacy, and enterprise compliance to align governance activities and manage risk consistently across organizational units.

Risk Assessment and Security Posture

• Lead the annual HIPAA Security Risk Analysis and coordinate remediation planning with technology and operational leaders.
• Conduct security risk assessments of infrastructure solutions and clinical platforms to evaluate control adequacy and identify gaps.
• Maintain a risk register and hold technology and operational leaders accountable to remediation timelines across the clinical, academic, research, and administrative technology portfolio.
• Perform business impact analysis to evaluate the effect of cybersecurity risks on critical clinical operations and business functions.
• Evaluate the cost-effectiveness of security controls through structured cost-benefit analysis to optimize risk reduction relative to available resources.
• Conduct cyber risk trend analysis and reporting to identify emerging threats and inform remediation priorities.
• Execute security authorization reviews for new system acquisitions and major system changes, with authority to withhold security authorization until risks are reduced to acceptable thresholds.

Governance, Policy and Compliance

• Author and maintain Dell Medical School cybersecurity policies, including policies that are more stringent than UT Austin baseline requirements where HIPAA, clinical operations, or research compliance demands.
• Ensure Dell Medical School security policies comply with applicable federal and state regulations and operate within the UT Austin enterprise security charter.
• Leverage applicable UT Austin security standards and guidelines and develop Dell Medical School-specific standards for clinical, biomedical, and clinical trial environments.
• Retain ownership of Dell Medical School security processes and procedures across operational domains.
• Identify top human cybersecurity risks and design behavioral mitigation campaigns targeting clinical, research, and administrative staff populations.
• Design and deliver a security awareness program using adult learning principles and maintain metrics to measure employee behavior change and program effectiveness.
• Respond to regulatory inquiries and support external audit engagements in coordination with Legal and Privacy while maintaining comprehensive compliance documentation.

Third-Party and Vendor Risk Management

• Develop and operate a vendor security assessment program covering new software acquisitions, SaaS platforms, and technology service providers.
• Review Business Associate Agreements and technology contracts for security requirements and appropriate data-handling provisions.
• Evaluate proposed vendor solutions through review of SOC 2 reports, penetration test results, and security questionnaire responses.
• Develop and maintain vendor security onboarding procedures, including risk tiering and baseline assessment requirements for new technology partners.
• Build escalation and communication plans for third-party risk events and develop remediation action plans when deficiencies are identified.
• Approve vendor onboarding based on security assessment outcomes in coordination with Procurement and Legal and withhold approval when security requirements are not met.

Incident Response and Business Continuity

• Own and maintain Dell Medical School’s incident response capability for events requiring a response beyond UT Austin’s initial handling scope.
• Develop business continuity and disaster recovery plans for clinical and business systems where Dell Medical School bears primary responsibility.
• Design tabletop exercise scenarios and coordinate preparedness exercises with internal teams and UT Austin campus security operations.
• Define escalation paths, communication protocols, and recovery playbooks for security events affecting clinical and business systems.
• Coordinate with legal, privacy, and communications teams to incorporate regulatory notification obligations and crisis communication requirements into response plans.

Research and Application Security Governance

• Establish and maintain cybersecurity governance requirements for research computing environments involving Controlled Unclassified Information (CUI), Protected Health Information (PHI), and export-controlled information.
• Define application security standards and secure coding requirements integrated throughout the software development and integration lifecycle.
• Oversee security testing activities, including static analysis and vulnerability scanning for internally developed and integrated applications.
• Facilitate threat modeling for new applications and services to identify and address security design risks before deployment.
• Develop and maintain cloud security governance policies covering SaaS platform adoption and cloud-hosted infrastructure.

Additional Responsibilities

• Represent the organization at cybersecurity and healthcare security conferences and industry forums.
• Participate in enterprise risk committees and strategic planning sessions.
• Maintain awareness of industry trends, emerging threats, and regulatory developments to continuously improve the GRC program.
• Perform related duties as required.

Required Qualifications

• Master’s degree in Information Technology, Cybersecurity, Health Informatics, or a related field.
• Minimum of five years of experience in progressive leadership roles in information security governance or Governance, Risk and Compliance (GRC).
• Minimum of eight years of experience in healthcare, banking, defense, or other high-security environments.
• CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager).

Relevant education and experience may be substituted as appropriate.

Preferred Qualifications

• Demonstrated experience conducting HIPAA Security Risk Analyses in a covered entity or business associate environment.
• Experience with CMMC or NIST 800-171 compliance programs in an academic or research setting.
• Experience managing third-party cybersecurity risk programs in a highly regulated environment.
• Experience designing cybersecurity awareness programs using behavior-based learning approaches.
• HCISPP (Healthcare Information Security and Privacy Practitioner).
• CRISC (Certified in Risk and Information Systems Control).
• CISA (Certified Information Systems Auditor).
• Healthcare-specific GRC certifications.

Salary Range

$170,368+ depending on qualifications

Working Conditions

• Standard office environment and equipment.
• Repetitive use of a keyboard.
• Standard exposure risk associated with a clinical and academic environment.

Required Materials

• Resume/CV
• 3 work references with their contact information; at least one reference should be from a supervisor
• Letter of interest

Employment Eligibility:

Regular staff who have been employed in their current position for the last six continuous months are eligible for openings being recruited for through University-Wide or Open Recruiting, to include both promotional opportunities and lateral transfers. Staff who are promotion/transfer eligible may apply for positions without supervisor approval.

Retirement Plan Eligibility:

The retirement plan for this position is Teacher Retirement System of Texas (TRS), subject to the position being at least 20 hours per week and at least 135 days in length. This position has the option to elect the Optional Retirement Program (ORP) instead of TRS, subject to the position being 40 hours per week and at least 135 days in length.

Background Checks:

A criminal history background check will be required for finalist(s) under consideration for this position.

Equal Opportunity Employer:

The University of Texas at Austin, as an equal opportunity/affirmative action employer,complies with all applicable federal and state laws regarding nondiscrimination and affirmative action. The University is committed to a policy of equal opportunity for all persons and does not discriminate on the basis of race, color, national origin, age, marital status, sex, sexual orientation, gender identity, gender expression, disability, religion, or veteran status in employment, educational programs and activities, and admissions.

Pay Transparency:

The University of Texas at Austin will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information.

Employment Eligibility Verification:

If hired, you will be required to complete the federal Employment Eligibility Verification I-9 form. You will be required to present acceptable and original documents to prove your identity and authorization to work in the United States. Documents need to be presented no later than the third day of employment. Failure to do so will result in loss of employment at the university.

E-Verify:

The University of Texas at Austin use E-Verify to check the work authorization of all new hires effective May 2015. The university’s company ID number for purposes of E-Verify is 854197. For more information about E-Verify, please see the following:

• E-Verify Poster (English and Spanish) [PDF]
• Right to Work Poster (English) [PDF]
• Right to Work Poster (Spanish) [PDF]

Compliance:

Employees may be required to report violations of law under Title IX and the Jeanne Clery Disclosure of Campus Security Policy and Crime Statistics Act (Clery Act). If this position is identified a Campus Security Authority (Clery Act), you will be notified and provided resources for reporting. Responsible employees under Title IX are defined and outlined in HOP-3031.

The Clery Act requires all prospective employees be notified of the availability of the Annual Security and Fire Safety report. You may access the most recent report here or obtain a copy at University Compliance Services, 1616 Guadalupe Street, UTA 2.206, Austin, Texas 78701.