Executive Director, Governance Risk & Compliance

• Provide enterprise leadership for security risk and compliance
• Set strategy, own GRC outcomes, and ensure regulatory alignment across the company and its subsidiaries
• Build and sustain the enterprise GRC framework
• Lead enterprise attestations and certifications, including SOX, HIPAA, and HITRUST
• Provide C-suite and Board reporting
• Govern security policy, exceptions, and security awareness initiatives
• Oversee third-party risk management
• Enable consistent identification, tracking, remediation, and reporting of enterprise security risks
• Oversee threat and vulnerability management processes
• Ensure adherence to established risk policies and standards
• Continuously improve security risk management capabilities and controls
• Own the enterprise information security risk posture and budget stewardship
• Drive cross-functional alignment with Legal, Compliance, IT, and Business stakeholders

• Bachelor’s degree and 15 years of experience in IT/Information Security; or 19 years of experience without a degree
• Minimum 7 years of people leadership experience (multi-team leadership preferred)
• Proven experience leading enterprise GRC programs, including risk, compliance, policy, third-party risk, and subsidiary governance
• Demonstrated success briefing executives/Board, owning budgets, and driving cross-functional outcomes
• Preferred:
  Executive experience with HIPAA/HITRUST and SOX regulatory regimes
• Preferred:
  Experience with NIST CSF/800-53 and ISO 27001 enterprise control frameworks

Demonstrates extensive expertise in enterprise governance, risk, and compliance (GRC) leadership, with a strong focus on regulatory alignment, risk management, and cross-functional collaboration. Proven ability to drive security initiatives, oversee compliance frameworks, and report to executive leadership.

• Enterprise GRC Leadership
• Risk Management
• Regulatory Compliance (SOX, HIPAA, HITRUST)
• People Leadership (Multi-Team)
• Cross-Functional Collaboration

• Risk Assessment
• Compliance Frameworks (NIST CSF, ISO 27001)
• Security Policy Governance
• Third-Party Risk Management
• Threat and Vulnerability Management
• Budget Stewardship
• Enterprise Attestations
• Security Awareness Initiatives
• Regulatory Alignment
• Reporting to Executives

• Leadership
• Strategic Thinking
• Communication
• Collaboration
• Problem-Solving

• Enterprise Risk Management
• Governance
• Compliance
• Security Risk Posture
• C-Suite Reporting