GRC Program Lead, Healthcare AI Compliance

Hippocratic AI Inc.; Menlo Park (CA); On-site; USD 180,000 - 280,000; Full time

Job summary

Hippocratic AI Inc. in Menlo Park seeks a GRC Program Lead to own and scale governance, risk, and compliance across SOC 2, HIPAA, HITRUST, GDPR, and AI governance.

You will coordinate with Sales, Engineering, DevOps, Clinical, and Legal to stay ahead of requirements for health systems, payors, pharma, and international markets. You will drive audits, DPIAs, data privacy, vendor risk, and risk management programs, delivering dashboards, policies, and training to foster a culture of compliance

Qualifications

• 5+ years in GRC, compliance, or audit roles
• Strong knowledge of healthcare regulations (HIPAA, HITRUST, SOC 2) and ISO 42001
• Experience with data privacy law (GDPR, UK GDPR) and cross-border transfers
• Hands-on with customer security assessments and GRC tooling (e.g., Vanta)
• Proven record leading risk assessments, audits, and vendor risk reviews
• Ability to present complex security topics clearly to executives and customers

Responsibilities

• Maintain SOC 2, HITRUST, HIPAA attestations and CMS regs; oversee compliance programs
• Implement ISO 42001 AI Management System and drive 2027 certification readiness
• Lead international data compliance for GDPR/UK GDPR and in-country data residency
• Monitor new obligations (e.g., DATC) and adapt controls
• Drive GovCloud, FedRAMP High and NIST SP 800-171 workstreams with docs and evidence
• Draft and communicate internal/external compliance policies
• Partner with CISO to identify, assess, and prioritize IT and security risks; maintain risk framework
• Execute third-party and fourth-party risk assessments
• Lead DPIAs, privacy reviews, data mappings, and privacy notices
• Conduct governance reviews and translate AI regulation requirements into controls
• Lead security audits and customer security assessments; manage questionnaires and RFPs
• Oversee annual customer assessments and renewals; focus on payor requirements and TPRM portals
• Deliver customer-facing and internal security/compliance presentations
• Own audit dashboards and public trust center; maintain evidence and certifications
• Build metrics framework; provide leadership reports and tabletop exercises
• Design training on patient privacy, data security, and regulatory requirements

Skills

GRC experience

HIPAA/HITRUST/SOC2 knowledge

GDPR/UK GDPR knowledge

Security assessments & TPRM

GRC tooling (Vanta)

Risk assessments & audits

Communication

Startup experience

Attention to detail

AI governance understanding

Education

Bachelor’s degree

Certifications (CISM, CRISC, CHPC) preferred

Tools

Vanta

Job description

Hippocratic AI Inc. in Menlo Park seeks a GRC Program Lead to own and scale governance, risk, and compliance across SOC 2, HIPAA, HITRUST, GDPR, and AI governance.

You will coordinate with Sales, Engineering, DevOps, Clinical, and Legal to stay ahead of requirements for health systems, payors, pharma, and international markets. You will drive audits, DPIAs, data privacy, vendor risk, and risk management programs, delivering dashboards, policies, and training to foster a culture of compliance