Principal Privacy & TPRM Risk Lead

Mayo Clinic; Rochester (MN); On-site; USD 120,000 - 180,000; Full time

Job summary

Mayo Clinic seeks a Privacy Third Party Risk Management Principal Risk Analyst to lead complex risk-related operations, special projects, and privacy initiatives. You will partner with Legal, IT, TPRM, and business stakeholders to design policies and processes aligned with Mayo Clinic’s risk tolerance.

The role involves third-party privacy risk assessments, Data Protection Impact Assessments, and executive communications. Some travel to Mayo Clinic sites may be required.

Qualifications

• Deep subject matter expertise in privacy compliance and investigations.
• Understanding of and ability to apply the Seven Elements of an Effective Compliance Program.
• Ability to carry out audits, assessments and investigations.
• Ability to use GRC software, monitoring tools, and issue management software.
• Ability to follow and apply legal holds and preservation of evidence and chain of custody protocols.

Responsibilities

• Lead risk business operations, special projects, investigations and mitigation development.
• Provide day-to-day guidance and project support to cross-functional teams.
• Develop policies and procedures to support Mayo Clinic’s risk tolerance.
• Communicate actionable risk guidance to leadership and business partners.

Skills

Privacy compliance

Regulatory investigations

Compliance program knowledge

Audits and investigations

Legal holds & preservation

Tools

GRC software

Monitoring tools

Issue management software

Job description

Mayo Clinic seeks a Privacy Third Party Risk Management Principal Risk Analyst to lead complex risk-related operations, special projects, and privacy initiatives. You will partner with Legal, IT, TPRM, and business stakeholders to design policies and processes aligned with Mayo Clinic’s risk tolerance.

The role involves third-party privacy risk assessments, Data Protection Impact Assessments, and executive communications. Some travel to Mayo Clinic sites may be required.