Director of Information Security GRC & Risk

Surescripts; Minneapolis (MN); Hybrid; USD 209,000 - 255,000; Full time

Benefits offered by this job

Healthcare

Paid time off

Parental leave

Mental health days

Pet insurance

401(k)

Job summary

Surescripts is seeking a Director of Governance, Risk and Compliance to oversee the GRC information security team, ensure regulatory and contractual compliance, and lead risk assessment, control testing, and training on information security policies. The role also manages business continuity and crisis management and drives a risk-aware culture across the enterprise.

The candidate will work with executives, manage third-party risk, and ensure policy alignment with standards like NIST CSF,

Qualifications

• Bachelor's degree in a technical, statistics, risk management field or equivalent.
• 10+ years of experience in related, progressive roles.
• Cyber security certification such as CISM, CGEIT, CRISC, CISA, CISSP.
• 5+ years of people management experience.
• 5+ years of information security risk management experience.
• Experience with AI and GRC Platforms.
• Experience communicating with senior executives.
• Strong understanding of control frameworks and certifications (NIST CSF, DirectTrust, HITRUST, SOC-2).
• Healthcare industry risk management experience.

Responsibilities

• Provide strategic oversight of information security compliance initiatives.
• Lead the Information Security GRC program alignment with business objectives.
• Own the information security control framework and assurance calendar.
• Lead third-party risk management for vendors handling PHI and security reviews.
• Advance security awareness and build a risk-intelligent culture.
• Establish and govern a comprehensive risk management program.
• Provide leadership oversight for continuous improvement and compliance.
• Collaborate cross-functionally to document risks, controls and report findings.
• Oversee business continuity planning and contingency testing across the enterprise.
• Develop and communicate the risk appetite framework and tolerance models.
• Build and lead the Information Security GRC team.

Skills

Governance

Risk Management

Policy Development

Security Awareness

Third-party risk

Leadership

Communication

Education

Bachelor's degree

Tools

GRC Platforms

NIST CSF

DirectTrust

HITRUST

SOC-2

Job description

Surescripts is seeking a Director of Governance, Risk and Compliance to oversee the GRC information security team, ensure regulatory and contractual compliance, and lead risk assessment, control testing, and training on information security policies. The role also manages business continuity and crisis management and drives a risk-aware culture across the enterprise.

The candidate will work with executives, manage third-party risk, and ensure policy alignment with standards like NIST CSF,