GRC & Cyber Risk Program Leader

UCSF; Oregon; Hybrid; USD 180,000 - 240,000; Full time

Job summary

UCSF is seeking a Head of Governance, Risk, and Compliance (GRC) to guide enterprise cyber risk management across UCSF Health, Campus, Foundation, and affiliates. You will lead a multi-disciplinary team, direct risk assessments, ensure PCI DSS, HIPAA, and NIST-aligned controls, and partner with auditors and senior leaders to implement policy and governance improvements.

Responsibilities include overseeing ServiceNow IRM workflows, developing metrics and training, and driving continuous process

Qualifications

• Bachelor's degree in related area or equivalent experience.
• Five (5) years of progressively responsible experience in cybersecurity, information security, governance, risk and compliance (GRC), or related field.
• Advanced knowledge of cybersecurity, privacy, and compliance laws, regulations, standards, and policy frameworks relevant to higher education and healthcare, including UC and UCSF policy, PCI DSS, HIPAA Security Rule, NIST frameworks, and audit expectations.
• Experience directing and coordinating the work of technical or risk/compliance staff, including assigning and prioritizing work, coaching, mentoring, training, and reviewing work quality.
• Experience providing day-to-day functional leadership for a security, risk, or compliance program, including coordination of operational activities, issue escalation, quality oversight, and continuous improvement.
• Advanced experience leading security risk assessments, compliance reviews, remediation planning, and risk-based decision-making across healthcare, research, education, implementation, and vendor environments.
• Demonstrated ability to determine, recommend, and communicate courses of action to departments and leadership on IT security, compliance, and risk matters in complex operational environments.
• Experience developing, implementing, and improving security workflows, standards, procedures, metrics, reporting, quality controls, and program documentation.
• Advanced experience with GRC or IRM platforms, risk assessment processes, security exceptions, risk acceptance, audit response, and related compliance activities.
• Advanced ability to analyze complex technical, operational, and compliance issues and develop defensible, risk-based recommendations using sound judgment.
• Broad knowledge of cybersecurity concepts and operating principles, including networks, applications, cloud services, encryption, identity and access management, logging, endpoint security, third-party services, enterprise applications, hardware, software, and vendor IT products.
• Strong written and verbal communication skills, including the ability to prepare reports, presentations, guidance, and other materials for varied audiences, including senior leadership.
• Experience interfacing with auditors, assessors, executives, project teams, and cross-functional stakeholders on significant security, compliance, or risk matters.
• Advanced interpersonal, consultative, and influence skills sufficient to work effectively with technical and non-technical personnel at all levels of the organization and build productive working relationships.

Responsibilities

• Provide functional leadership for the Cyber Risk & Assurance team through daily and weekly stand-ups, mentoring, training, escalation handling, and governance cadence support.
• Lead Cyber Risk & Assurance program development and operations, including ServiceNow IRM and related workflow design, metrics, reporting, and continuous process improvement.
• Lead complex enterprise cyber risk and compliance assessments across vendor, implementation, healthcare, education, and vendor environments; determine approach and guide risk mitigations and actions.
• Serve as UCSF's lead PCI DSS subject matter expert and coordinate PCI-related compliance activities and assessments.
• Develop and maintain policy, standards, and governance content aligned to UC policy, UCSF security requirements, HIPAA, NIST, PCI DSS.

Skills

Leadership

Communication skills

Security risk management

Policy interpretation

Contract reviews

Third-party reviews

Auditing coordination

Staff mentoring

Governance

Education

Bachelor's degree

Tools

ServiceNow IRM

ITSM

Job description

UCSF is seeking a Head of Governance, Risk, and Compliance (GRC) to guide enterprise cyber risk management across UCSF Health, Campus, Foundation, and affiliates. You will lead a multi-disciplinary team, direct risk assessments, ensure PCI DSS, HIPAA, and NIST-aligned controls, and partner with auditors and senior leaders to implement policy and governance improvements.

Responsibilities include overseeing ServiceNow IRM workflows, developing metrics and training, and driving continuous process