Head of GRC & Enterprise Security Risk

HCSC; Chicago (IL); On-site; USD 178,000 - 330,000; Full time

Job summary

Health Care Service Corporation is seeking an Executive Director to provide enterprise leadership for security risk and compliance, setting strategy and owning GRC outcomes across the company and subsidiaries. You will lead attestations and certifications and report to the C‑Suite and Board on risk posture and governance.

You will oversee policies, risk controls, and cross‑functional collaboration with Legal, Compliance, IT, and business stakeholders to improve threat management and regulatory

Qualifications

• Bachelor’s degree and 15+ years in IT/Information Security, or 19+ years without a degree.
• Minimum 7 years of people leadership experience.
• Proven experience leading enterprise GRC programs (risk, compliance, policy, third‑party risk, subsidiary governance).
• Experience briefing executives/Board, owning budgets, and driving cross‑functional outcomes.

Responsibilities

• Lead enterprise GRC framework and attestations including SOX, HIPAA, and HITRUST.
• Oversee security policy, exceptions, awareness initiatives, and third‑party risk management.
• Ensure consistent identification, remediation, and reporting of security risks across the enterprise.
• Collaborate with Legal, Compliance, IT, and business stakeholders to align risk strategy.

Skills

People leadership

GRC programs

Budget ownership

Executive briefing

Regulatory knowledge

Education

Bachelor’s degree or equivalent experience

Tools

NIST CSF/800-53

ISO 27001

Job description

Health Care Service Corporation is seeking an Executive Director to provide enterprise leadership for security risk and compliance, setting strategy and owning GRC outcomes across the company and subsidiaries. You will lead attestations and certifications and report to the C‑Suite and Board on risk posture and governance.

You will oversee policies, risk controls, and cross‑functional collaboration with Legal, Compliance, IT, and business stakeholders to improve threat management and regulatory