Global Risk Compliance

Hippocratic AI Inc.; Menlo Park (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Hippocratic AI Inc. in Menlo Park seeks a GRC Program Lead to own and scale governance, risk, and compliance across SOC 2, HIPAA, HITRUST, GDPR, and AI governance.

You will coordinate with Sales, Engineering, DevOps, Clinical, and Legal to stay ahead of requirements for health systems, payors, pharma, and international markets. You will drive audits, DPIAs, data privacy, vendor risk, and risk management programs, delivering dashboards, policies, and training to foster a culture of compliance

Qualifications

• 5+ years in GRC, compliance, or audit roles
• Strong knowledge of healthcare regulations (HIPAA, HITRUST, SOC 2) and ISO 42001
• Experience with data privacy law (GDPR, UK GDPR) and cross-border transfers
• Hands-on with customer security assessments and GRC tooling (e.g., Vanta)
• Proven record leading risk assessments, audits, and vendor risk reviews
• Ability to present complex security topics clearly to executives and customers

Responsibilities

• Maintain SOC 2, HITRUST, HIPAA attestations and CMS regs; oversee compliance programs
• Implement ISO 42001 AI Management System and drive 2027 certification readiness
• Lead international data compliance for GDPR/UK GDPR and in-country data residency
• Monitor new obligations (e.g., DATC) and adapt controls
• Drive GovCloud, FedRAMP High and NIST SP 800-171 workstreams with docs and evidence
• Draft and communicate internal/external compliance policies
• Partner with CISO to identify, assess, and prioritize IT and security risks; maintain risk framework
• Execute third-party and fourth-party risk assessments
• Lead DPIAs, privacy reviews, data mappings, and privacy notices
• Conduct governance reviews and translate AI regulation requirements into controls
• Lead security audits and customer security assessments; manage questionnaires and RFPs
• Oversee annual customer assessments and renewals; focus on payor requirements and TPRM portals
• Deliver customer-facing and internal security/compliance presentations
• Own audit dashboards and public trust center; maintain evidence and certifications
• Build metrics framework; provide leadership reports and tabletop exercises
• Design training on patient privacy, data security, and regulatory requirements

Skills

GRC experience

HIPAA/HITRUST/SOC2 knowledge

GDPR/UK GDPR knowledge

Security assessments & TPRM

GRC tooling (Vanta)

Risk assessments & audits

Communication

Startup experience

Attention to detail

AI governance understanding

Education

Bachelor’s degree

Certifications (CISM, CRISC, CHPC) preferred

Tools

Vanta

TPRM portals

Job description

About the Role

Hippocratic AI is looking for a GRC Program Lead to own and scale our governance, risk, and compliance program. Reporting to the CISO, you will be the central point of contact for certifications and attestations (SOC 2, HITRUST, HIPAA, ISO 42001), customer security assurance, U.S. and international data privacy, regulatory and AI governance initiatives, and enterprise risk management. You will work across Sales, Engineering, DevOps, Clinical, and Legal teams to keep our compliance posture ahead of the demands of health systems, payors, pharma and life‑science partners, federal customers, and new international markets.

Responsibilities

Certifications, Frameworks & Compliance Programs

• Framework and certification oversight: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de‑identification standards and applicable CMS regulations and federal guidelines.

• ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027.

• International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross‑border transfer mechanisms, in‑country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act) as we enter new markets.

• Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC) as they apply to our business.

• Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence.

• Policy management: Draft, update, and communicate internal and external compliance policies.

Risk, Privacy & Governance

• Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and run quarterly risk reviews.

• Vendor risk: Execute third‑party (and fourth‑party) compliance and risk assessments.

• Data privacy: Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, data residency and regulatory analysis, and privacy documentation (records of processing, data maps, privacy notices) for U.S. and international jurisdictions.

• AI governance: Conduct governance reviews against emerging AI laws and regulations and translate requirements into program controls.

Audit, Assurance & Program Operations

• Audits and customer assessments: Serve as the lead and central point of contact for external audits and customer security assessments; manage and execute security questionnaires, RFP responses, customer calls, and follow‑ups, pairing AI‑assisted drafting with rigorous human review.

• Annual assessments and renewals: Conduct and oversee customer annual assessments and renewals, with a focus on payor‑side compliance requirements and provider third‑party risk management (TPRM) portals.

• Presentations: Deliver customer‑facing and internal presentations on our security and compliance program, including customer security reviews, sales support calls, executive briefings, and team training sessions.

• Trust center and dashboards: Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current; program‑manage internal non‑compliance processes through remediation.

• Metrics and reporting: Build and maintain a metrics and reporting framework that measures program effectiveness and raises security maturity, including clear, actionable leadership reports and tabletop exercises.

• Training and culture: Design and deliver targeted training on patient privacy, data security, and regulatory requirements; foster a culture of compliance across clinical, administrative, and technical teams.

Qualifications & Skills

• AI skillset and examples of use

• Bachelor’s degree; CISM, CRISC, CHPC, or similar certifications preferred.

• 5+ years in GRC, compliance, or audit, ideally in a healthcare or payor environment.

• Strong working knowledge of healthcare regulations and frameworks, including HIPAA, HITRUST, SOC 2, and ISO 42001.

• Working knowledge of international data protection and privacy law (GDPR and UK GDPR, cross‑border transfers, data residency) and experience translating it into operational controls.

• Hands‑on experience with customer security assessments, TPRM portals, and GRC or trust‑center tooling (e.g., Vanta).

• Proven experience leading risk assessments, audits, vendor risk reviews, and compliance reviews, with strong analytical, problem‑solving, and communication skills.

• Confident presenter able to explain complex security and compliance topics clearly to customers, executives, and non‑technical audiences.

• Startup experience; comfortable operating with ambiguity and minimal supervision.

• Detail‑oriented, organized, and adaptable, with high integrity, discretion, and ethical standards; collaborates effectively across clinical, administrative, and technical teams.

Nice to Have

• Experience with FedRAMP High, GovCloud, and NIST SP 800-53 / 800-171, including authorization or readiness efforts for federal customers.

• Experience in a pharma or life‑science environment, including quality and validation frameworks such as GxP, GAMP 5, CSV, 21 CFR Part 11, and ALCOA+, and exposure to SaMD or ISO 13485.

• Privacy certifications (CIPP/E, CIPP/US, CIPM), experience with ISO 27001 / 27701, and familiarity with emerging AI governance regulations such as the EU AI Act.

Why Join Hippocratic AI

Reinvent healthcare with AI that puts safety first. We’re building the world’s first healthcare‑only, safety‑focused LLM — a breakthrough platform designed to transform patient outcomes at a global scale. This is category creation.

Work with the people shaping the future. Hippocratic AI was co‑founded by CEO Munjal Shah and a team of physicians, hospital leaders, AI pioneers, and researchers from institutions like El Camino Health, Johns Hopkins, Washington University in St. Louis, Stanford, Google, Meta, Microsoft, and NVIDIA.

Backed by the world’s leading healthcare and AI investors. We recently raised a $126M Series C at a $3.5B valuation, led by Avenir Growth, bringing total funding to $404M with participation from CapitalG, General Catalyst, a16z, Kleiner Perkins, Premji Invest, UHS, Cincinnati Children’s, WellSpan Health, John Doerr, Rick Klausner, and others.

Build alongside the best in healthcare and AI. Join experts who’ve spent their careers improving care, advancing science, and building world‑changing technologies — ensuring our platform is powerful, trusted, and truly transformative.

Equal Opportunity

Hippocratic AI is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, national origin, sex, age, disability, sexual orientation, gender identity or expression, genetic information, military or veteran status, or any other characteristic protected by applicable law. We are committed to building a team that reflects the patients we serve. We actively encourage applications from candidates of all backgrounds. If you require accommodations during the hiring process, please contact [e-mail].