Security GRC Leader — AI Governance & Compliance

We are excited that you are considering joining Nova Southeastern University!

Nova Southeastern University (NSU) was founded in 1964, and is a not-for-profit, independent university with a reputation for academic excellence and innovation. Nova Southeastern University offers competitive salaries, a comprehensive benefits package including tuition waiver, retirement plan, excellent medical and dental plans and much more. NSU cares about the health and welfare of its students, faculty, staff, and campus visitors and is a tobacco-free university.

We appreciate your support in making NSU the preeminent place to live, work, study and grow. Thank you for your interest in a career with Nova Southeastern University.

Primary Purpose:

Directs the University’s information security governance, risk, and compliance program, including the security control framework, enterprise risk register, policy lifecycle, audits and assessments, third-party risk, security awareness, and AI governance. Translates regulatory, contractual, accreditation, and research security requirements, into documented, tested, and audit-ready controls, serving as the accountable owner for ensuring controls are implemented, effective, and defensible to auditors, regulators, sponsors, and the Board.

Job Category:Exempt

Hiring Range:

Pay Basis: Annually

Subject to Grant Funding?No

Essential Job Functions:

1. Oversees, maintains, and matures the university’s information security control framework, mapping controls to NIST Cybersecurity Framework 2.0 and cross walking to HIPAA Security Rule, PCI-DSS, GLBA Safeguards Rule, FERPA, NIST SP 800-171/CMMC, and applicable state breach notification law.

2. Establishes and maintains the enterprise information security risk register, including risk identification, scoring methodology, treatment plans, risk acceptance and exception workflow, executive escalation thresholds, and periodic reassessment.

3. Manages the information security policy lifecycle — authoring, revising, routing for review and approval, publishing, communicating, and retiring policies, standards, procedures, and guidelines on a defined review cycle.

4. Leads the university’s response to internal audit, external audit, regulatory examination, cyber insurance underwriting, sponsor security reviews, and customer or partner security questionnaires; coordinates evidence collection, control owner interviews, findings remediation, and corrective action plan tracking to closure.

5. Designs and operates the third-party and vendor security risk management program, including intake and tiering, pre-contract security assessment, SOC 2 and comparable attestation review, contractual security and breach notification terms in partnership with Legal and Procurement, and ongoing monitoring of critical vendors.

6. Extends the governance program to AI-enabled systems and services by establishing acceptable-use guardrails, AI and model vendor risk review criteria, data classification and data exposure controls for AI platforms, and documented evidence of compliance, aligned to the NIST AI Risk Management Framework and coordinated with university AI governance bodies.

7. Performs and coordinates control testing and continuous control monitoring; collects and maintains audit evidence, control owner attestations, and a defensible system of record for compliance artifacts.

8. Designs, delivers, and measures the security awareness and training program, including role-based training, annual policy attestation, phishing simulation, and reporting on behavioral risk indicators.

9. Monitors changes in law, regulation, accreditation standards, sponsor requirements, and industry frameworks; assesses institutional impact and translates changes into control, policy, and…