Director Governance Risk and Compliance

Surescripts serves the nation through simpler, trusted health intelligence sharing, in order to increase patient safety, lower costs and ensure quality care . We deliver insights at critical points of care for better decisions — from streamlining prior authorizations to delivering comprehensive medication histories to facilitating messages between providers.   Job Summary: The Director of Governance, Risk and Compliance provides strategic oversight of the Governance Risk and Compliance (GRC) information security team to ensure compliance with regulatory and contractual requirements. This role is responsible for creating, maintaining, and training on all Information Security Policy and Standards. This role leads a team that provides project risk assessment, project security subject matter expertise, and third-party security risk assessment. This role also oversees all business continuity and crisis management efforts across the enterprise along with overseeing and managing the information security training and awareness program. Responsibilities: Provide strategic oversight of information security compliance initiatives to ensure rigorous alignment with all applicable information security regulatory standards and contractual obligations. Oversee and provide leadership direction for the Information Security GRC program, aligning with business objectives. Own the Information Security control framework and the annual assurance calendar —including scoping, evidence collection, control testing, auditor management, and remediation tracking to closure. Lead third-party risk management for vendors and downstream partners handling PHI, including due diligence, BAA security terms, and ongoing monitoring; serve as the security escalation point for customer and partner security reviews, questionnaires, and contractual security obligations. Advance organizational cyber security awareness by developing and implementing tactical strategies that foster a risk-intelligent culture. Lead and coordinate security awareness initiatives to consistently enhance cyber security knowledge and practices throughout the organization. Establish and govern a comprehensive risk management program—covering internal and external risk assessments—to strengthen organizational resilience, compliance, and decision‑making. Provide leadership oversight to ensure continuous improvement and organizational compliance. Collaborate cross functionally with subject matter experts to document the risks and controls, measure the control effectiveness and report the findings through key risk and performance indicators. Provide oversight to ensure that business continuity plans are reviewed annually. Collaborate with cross-functional teams across Surescripts to develop, test, and validate contingency plans for critical business operations, thereby strengthening organizational resilience and preparedness. Develop, maintain and communicate the risk appetite framework and…