IT Security Supervisor, GRC

UCSF Health; San Francisco (CA); In loco; USD 180.000 - 280.000; Tempo pieno

Descrizione del lavoro

UCSF Health seeks a strategic Head of Governance, Risk, and Compliance to lead enterprise cyber risk and regulatory compliance across UCSF Health, Campus, Foundation, and affiliates. You will guide the GRC team, mentor staff, and coordinate with senior leaders and auditors on complex risk programs.

Role requires in-depth knowledge of HIPAA, PCI-DSS, NIST, and UC policies, with a track record of risk-based decision making and program optimization.

Competenze

• Bachelor's degree in related area or equivalent experience/training.
• Minimum 5 years in cybersecurity, information security, GRC or related.
• Advanced knowledge of cybersecurity, privacy, and compliance laws/frameworks relevant to higher ed and healthcare.
• Experience directing and coordinating technical or risk/compliance staff.
• Experience providing day-to-day functional leadership for security, risk, or compliance programs.
• Advanced experience leading security risk assessments, compliance reviews, remediation planning, and risk-based decisions.
• Ability to communicate actions to departments and leadership on IT security, compliance, and risk.
• Experience developing and improving security workflows, metrics, and program docs.
• Advanced experience with GRC/IRM platforms, risk assessments, risk acceptance, and audit responses.

Mansioni

• Lead enterprise cyber risk and compliance services across UCSF Health and affiliates.
• Direct day-to-day execution of GRC activities and staff direction.
• Interface with senior stakeholders, auditors, and business owners for guidance and direction.
• Oversee policy interpretation, contract reviews, third-party reviews, and compliance activities (PCI-DSS, HIPAA, NIST).
• Drive program improvements including ITSM workflows, metrics, and training.
• Utilize AI solutions to increase service capacity and delivery speed.
• Collaborate with UC system offices on system-wide initiatives.

Conoscenze

GRC leadership

Risk assessment

Regulatory knowledge

Audit coordination

Stakeholder communication

Team mentoring

Formazione

Bachelor's degree in related field

Strumenti

ServiceNow IRM

GRC/ITSM platforms

Privacy regulations knowledge

Descrizione del lavoro

Job Description

The Head of Governance, Risk, and Compliance (GRC), supports the Manager of Cyber Risk Management with their expert knowledge of cybersecurity risk management, contractual and regulatory compliance, and security control frameworks to analyze and manage risk institution-wide security issues across UCSF Health, Campus, Foundation, and affiliated environments. Serves as functional leader for GRC team and directs day-to-day execution of enterprise cyber risk and compliance services. Provides sustained staff direction, work prioritization, mentoring, training, escalation handling, and quality oversight across complex risk assessments, including AI solutions; security exceptions; policy interpretation; contract reviews, third-party reviews; and enterprise compliance activities, including PCI-DSS, HIPAA, UC policy, and NIST-based frameworks. Leads projects and program improvements with organization-wide impact, including ServiceNow IRM and IT Service Management workflows, metrics, training, quality controls, and operating standards. Employ AI solutions to increase service capacity and accelerate delivery. Regularly interfaces with senior stakeholders, auditors, and business owners and provides expert guidance and operational direction to team members. Works with the UC Office of the President and other UC campuses on system-wide initiatives. The proposed IT Security Supervisor 2 classification reflects the closest available title for a role that now carries sustained staff direction, program accountability, and enterprise operational leadership responsibilities.

Job Description

The Head of Governance, Risk, and Compliance (GRC), supports the Manager of Cyber Risk Management with their expert knowledge of cybersecurity risk management, contractual and regulatory compliance, and security control frameworks to analyze and manage risk institution-wide security issues across UCSF Health, Campus, Foundation, and affiliated environments. Serves as functional leader for GRC team and directs day-to-day execution of enterprise cyber risk and compliance services. Provides sustained staff direction, work prioritization, mentoring, training, escalation handling, and quality oversight across complex risk assessments, including AI solutions; security exceptions; policy interpretation; contract reviews, third-party reviews; and enterprise compliance activities, including PCI-DSS, HIPAA, UC policy, and NIST-based frameworks. Leads projects and program improvements with organization-wide impact, including ServiceNow IRM and IT Service Management workflows, metrics, training, quality controls, and operating standards. Employ AI solutions to increase service capacity and accelerate delivery. Regularly interfaces with senior stakeholders, auditors, and business owners and provides expert guidance and operational direction to team members. Works with the UC Office of the President and other UC campuses on system-wide initiatives. The proposed IT Security Supervisor 2 classification reflects the closest available title for a role that now carries sustained staff direction, program accountability, and enterprise operational leadership responsibilities.

Department Overview

UCSF Cybersecurity protects and responds to both internal and external threats. It monitors vulnerabilities, risks, and exposures and mitigates issues prior to exploitation. If an incident does occur, IT Security investigates, determines impact, and recommends controls for reduced recurrence likelihood.

• Vulnerability Management
• Network Security
• Data security and protection
• Security architecture and design review
• Incident response and forensic analysis
• Cyber threat intelligence
• Threat hunting and event analysis
• Establishing policies and standards for information security
• Conducting security risk assessments of systems, solutions, and vendors
• Governance, risk, and compliance
• Architecting secure business solutions
• Outreach and security awareness training and education
• Endpoint security, including encryption, anti-malware, endpoint detection and response
• Application security
• E-Discovery and forensic services

Qualifications

REQUIRED QUALIFICATIONS

• Bachelor's degree in related area and or equivalent experience and training.
• Minimum of five (5) years of progressively responsible experience in cybersecurity, information security, governance, risk and compliance (GRC), or related field
• Advanced knowledge of cybersecurity, privacy, and compliance laws, regulations, standards, and policy frameworks relevant to higher education and healthcare, including UC and UCSF policy, PCI DSS, HIPAA Security Rule, NIST frameworks, and audit expectations.
• Experience directing and coordinating the work of technical or risk/compliance staff, including assigning and prioritizing work, setting expectations, coaching, mentoring, training, and reviewing work quality.
• Experience providing day-to-day functional leadership for a security, risk, or compliance program, including coordination of operational activities, issue escalation, quality oversight, and continuous improvement.
• Advanced experience leading security risk assessments, compliance reviews, remediation planning, and risk-based decision-making across healthcare, research, education, implementation, and vendor environments.
• Demonstrated ability to determine, recommend, and communicate courses of action to departments and leadership on IT security, compliance, and risk matters in complex operational environments.
• Experience developing, implementing, and improving security workflows, standards, procedures, metrics, reporting, quality controls, and program documentation.
• Advanced experience with GRC or IRM platforms, risk assessment processes, security exceptions, risk acceptance, audit response, and related compliance activities.
• Advanced ability to analyze complex technical, operational, and compliance issues and develop defensible, risk-based recommendations using sound judgment.
• Broad knowledge of cybersecurity concepts and operating principles, including networks, applications, cloud services, encryption, identity and access management, logging, endpoint security, third-party services, enterprise applications, hardware, software, and vendor IT products.
• Strong written and verbal communication skills, including the ability to prepare reports, presentations, guidance, and other materials for varied audiences, including senior leadership.
• Experience interfacing with auditors, assessors, executives, project teams, and cross-functional stakeholders on significant security, compliance, or risk matters.
• Advanced interpersonal, consultative, and influence skills sufficient to work effectively with technical and non-technical personnel at all levels of the organization and build productive working relationships.

Preferred Qualifications

• Advanced coursework or training in cybersecurity, risk management, audit, or compliance.
• Minimum of three (3) years of experience supervising, leading, or providing sustained direction to professional staff
• Knowledge of institutional processes, governance structures, and regulated data environments in higher education and/or healthcare.
• ServiceNow IRM, GRC, or ITSM experience.
• Certifications
• PCI ISA
• CISSP
• CISA or CRISC
• ServiceNow IRM, GRC, or comparable platform certification

About Us

About UCSF

The University of California, San Francisco (UCSF) is a leading university dedicated to promoting health worldwide through advanced biomedical research, graduate-level education in the life sciences and health professions, and excellence in patient care. It is the only campus in the 10-campus UC system dedicated exclusively to the health sciences. We bring together the world’s leading experts in nearly every area of health. We are home to five Nobel laureates who have advanced the understanding of cancer, neurodegenerative diseases, aging and stem cells.

Pride Values

UCSF is a diverse community made of people with many skills and talents. We seek candidates whose work experience or community service has prepared them to contribute to our commitment to professionalism, respect, integrity, diversity and excellence – also known as our PRIDE values.

In addition to our PRIDE values, UCSF is committed to equity – both in how we deliver care as well as our workforce. We are committed to building a broadly diverse community, nurturing a culture that is welcoming and supportive, and engaging diverse ideas for the provision of culturally competent education, discovery, and patient care. Additional information about UCSF is available here .

Join us to find a rewarding career contributing to improving healthcare worldwide.

Equal Employment Opportunity

The University of California is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, protected veteran status, or other protected status under state or federal law.

Salary Information

The final salary and offer components are subject to additional approvals based on UC policy.

Your placement within the salary range is dependent on a number of factors including your work experience and internal equity within this position classification at UCSF. For positions that are represented by a labor union, placement within the salary range will be guided by the rules in the collective bargaining agreement.

To learn more about the benefits of working at UCSF, including total compensation, please visit: https://ucnet.universityofcalifornia.edu/compensation-and-benefits/index.html