IT Risk and Compliance Manager

University of Colorado; United States; Hybrid; USD 110,000 - 170,000; Full time

Job summary

University of Colorado Anschutz Information Strategy and Services seeks an IT Risk and Compliance Manager to lead a university-wide program protecting data and technology. You will manage a team, drive risk assessments, and ensure policy development aligns with HIPAA, FERPA, PCI, FISMA, and related regulations.

You will collaborate across researchers, healthcare partners, legal, privacy, procurement, and IT teams to implement controls, monitor risks, and deliver practical guidance for

Qualifications

• Advanced knowledge of IT risk management, information security, regulatory compliance.
• Experience interpreting and applying HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC.
• Ability to translate technical, regulatory, and risk information into clear guidance for varied audiences.
• Strong analytical, communication, decision-making, and leadership skills.

Responsibilities

• Lead and develop a team of IT risk and compliance professionals, setting priorities and supporting growth.
• Lead the university's IT risk and compliance program, including risk assessments, policy development, monitoring and reporting.
• Oversee risk and compliance assessments for university and third-party systems, cloud services, AI technologies, and other technologies, documenting controls and treatments.
• Build partnerships across the university to address IT risk and compliance needs with researchers, technology teams, legal counsel, privacy, procurement, and administrators.
• Strengthen security practices by reviewing contracts and cloud service agreements and addressing risks.
• Modernize services by implementing GRC tools and improving workflows with measurable reporting.

Skills

Leadership

Risk management

Information security

Regulatory compliance

Communication

Project management

Relationship-building

Job description

University of Colorado Anschutz

Department: Information Strategy and Services

Job Title: IT Risk and Compliance Manager

Position #: 00002161 - Requisition #: 41601

Job Summary:

Does This Describe You?

Are you an experienced IT risk and compliance leader who enjoys turning complex regulatory requirements into practical solutions? Do you thrive in a collaborative environment where you can lead a talented team, modernize services, and help stakeholders make informed technology decisions?

Information Strategy and Services (ISS) is seeking an IT Risk and Compliance Manager to lead university-wide IT risk and compliance operations supporting the University of Colorado Anschutz Medical Campus and the University of Colorado Denver. This position combines people leadership, technical expertise, strategic planning, and partnership to protect university data and technology while supporting the university's missions.

We are looking for an inclusive leader to manage our IT Risk and Compliance team, reduce university risk, and ensure compliance with requirements such as HIPAA, FERPA, PCI, and FISMA. If you think you have what it takes to lead this team, we want to know more about YOU!

What You'll Do

• Lead and develop a team of IT risk and compliance professionals, setting priorities, managing workloads and performance, and supporting professional growth.
• Lead the university's IT risk and compliance program, including risk assessments, regulatory compliance, policy development, monitoring, reporting, and continuous improvement.
• Oversee risk and compliance assessments for university and third-party systems, applications, cloud services, AI technologies, and other technologies, ensuring risks, requirements, controls, and recommended treatments are documented.
• Build partnerships across the university to identify and address IT risk and compliance needs with researchers, healthcare partners, technology teams, legal counsel, privacy, procurement, administrators, and other stakeholders.
• Strengthen technology and vendor security practices, including reviewing contracts and cloud service agreements and addressing security requirements and identified risks.
• Modernize IT risk and compliance services by implementing GRC tools, improving workflows, and using monitoring, metrics, and reporting to improve service delivery.

What Success Looks Like

• The IT risk and compliance team has clear priorities, service expectations, and opportunities for professional growth.
• University stakeholders receive practical, timely guidance to understand and address technology risks and compliance requirements.
• Security and compliance risks are consistently identified, documented, assigned, monitored, and addressed.
• Risk and compliance services become more efficient, responsive, scalable, and easier to navigate.
• Compliance programs, policies, assessments, risk registers, and reporting remain organized, current, and aligned with university and ISS priorities.
• The manager builds trusted relationships across technical, research, clinical, legal, privacy, procurement, and administrative functions.

What You'll Bring

• Strong leadership and operational management skills, including team development, performance management, workload planning, and service oversight.
• Advanced knowledge of IT risk management, information security, regulatory compliance, security controls, and risk mitigation.
• Experience interpreting and applying requirements such as HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC.
• Ability to translate technical, regulatory, and risk information into clear, practical guidance for varied audiences.
• Strong analytical, communication, decision-making, project management, and relationship-building skills.
• A collaborative, accountable, and service-oriented leadership approach focused on technical excellence and continuous improvement.

Work Location:

Hybrid -ISS supports a flexible work environment while recognizing the value of in-person collaboration. This position requires a minimum of three days per week on campus, with additional in-person presence as needed for meetings, activities, collaboration engagements, or operational needs. The work schedule will be based around core working hours in Colorado Mountain Time.

Why Join Us:

Information Strategy and Services (ISS) partners across the campus to deliver information technology services that empower teaching, learning, research, and patient care. ISSpresent? Actually

Together, we connect service and technology .

Our work is guided by six shared principles that connect our teams and shape how we serve our customers:

• Curiosity- Explore beyond one's own experience and environment.
• Compassion- Demonstrates empathy, understanding, and respect for all people.
• Collaboration- Partner well beyond our space and build partnerships to achieve organizational r