Strategic GRC Executive Director: Security & Compliance

Health Care Service Corp.; Richardson (TX); On-site; USD 178,000 - 330,000; Full time

Benefits offered by this job

Health benefits

401(k)

Pension plan

Paid time off

Paid parental leave

Disability insurance

Life insurance

Employee assistance program

Paid holidays

Tuition reimbursement

Job summary

Health Care Service Corporation (HCSC) seeks an Executive Director to lead security risk and compliance across the enterprise, aligning with Legal, Compliance, IT, and business stakeholders. You will own the GRC framework, drive attestations and certifications, and deliver board‑level reporting on risk posture.

The role oversees policy, third‑party risk, and threat management programs, with budget stewardship and cross‑functional collaboration to strengthen enterprise security controls.

Qualifications

• Bachelor’s degree and 15 years of experience in IT/Information Security; or 19 years of experience without a degree.
• Minimum 7 years of people leadership experience (multi‑team leadership preferred).
• Proven experience leading enterprise GRC programs (risk, compliance, policy, third‑party risk, subsidiary governance).

Responsibilities

• Set strategy for security risk and compliance across the company and subsidiaries.
• Oversee enterprise GRC framework, attestations, and certifications (SOX, HIPAA, HITRUST).
• Govern security policy, awareness initiatives, third‑party risk management, and risk reporting to executives/Board.

Skills

People leadership

Strategic leadership

Executive communication

GRC domain knowledge

Education

Bachelor’s degree + 15 years IT/Security OR 19 years without degree

Tools

NIST CSF/800-53

ISO 27001

SOX/HIPAA/HITRUST knowledge

Job description

Health Care Service Corporation (HCSC) seeks an Executive Director to lead security risk and compliance across the enterprise, aligning with Legal, Compliance, IT, and business stakeholders. You will own the GRC framework, drive attestations and certifications, and deliver board‑level reporting on risk posture.

The role oversees policy, third‑party risk, and threat management programs, with budget stewardship and cross‑functional collaboration to strengthen enterprise security controls.