IT Risk & Compliance Leader (Hybrid) | HIPAA, FERPA, PCI

University of Colorado; United States; Hybrid; USD 110,000 - 170,000; Full time

Job summary

University of Colorado Anschutz Information Strategy and Services seeks an IT Risk and Compliance Manager to lead a university-wide program protecting data and technology. You will manage a team, drive risk assessments, and ensure policy development aligns with HIPAA, FERPA, PCI, FISMA, and related regulations.

You will collaborate across researchers, healthcare partners, legal, privacy, procurement, and IT teams to implement controls, monitor risks, and deliver practical guidance for

Qualifications

• Advanced knowledge of IT risk management, information security, regulatory compliance.
• Experience interpreting and applying HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC.
• Ability to translate technical, regulatory, and risk information into clear guidance for varied audiences.
• Strong analytical, communication, decision-making, and leadership skills.

Responsibilities

• Lead and develop a team of IT risk and compliance professionals, setting priorities and supporting growth.
• Lead the university's IT risk and compliance program, including risk assessments, policy development, monitoring and reporting.
• Oversee risk and compliance assessments for university and third-party systems, cloud services, AI technologies, and other technologies, documenting controls and treatments.
• Build partnerships across the university to address IT risk and compliance needs with researchers, technology teams, legal counsel, privacy, procurement, and administrators.
• Strengthen security practices by reviewing contracts and cloud service agreements and addressing risks.
• Modernize services by implementing GRC tools and improving workflows with measurable reporting.

Skills

Leadership

Risk management

Information security

Regulatory compliance

Communication

Project management

Relationship-building

Job description

University of Colorado Anschutz Information Strategy and Services seeks an IT Risk and Compliance Manager to lead a university-wide program protecting data and technology. You will manage a team, drive risk assessments, and ensure policy development aligns with HIPAA, FERPA, PCI, FISMA, and related regulations.

You will collaborate across researchers, healthcare partners, legal, privacy, procurement, and IT teams to implement controls, monitor risks, and deliver practical guidance for