Governance, Risk, and Compliance Lead

Responsibilities

• Design, implement, and oversee IT compliance and governance programs aligned with HIPAA, GDPR, and CCPA
• Develop and refine IT security policies, standards, and procedures
• Build and maintain a robust risk management framework to identify and mitigate IT and operational risks
• Conduct regular risk assessments, internal audits, and control evaluations
• Manage internal and external audit processes and ensure timely resolution of findings
• Design and deliver compliance and security awareness training programs
• Lead internal investigations into compliance violations or data incidents
• Develop and implement corrective action plans to address compliance gaps

Requirements

• Bachelor's degree in IT, Computer Science, Cybersecurity, Risk Management, or related field
• 5+ years of experience in GRC, IT compliance, or cybersecurity assurance
• Deep expertise in HIPAA, GDPR, CCPA, NIST, ISO 27001, and SOC 2
• Proven experience in internal audits and risk assessments in regulated environments
• Demonstrated ability in vendor risk management and third-party audits
• Strong written and verbal communication skills

Preferred Qualifications

• Professional certifications such as CISA, CISM, CISSP, ISO 27001 Lead Auditor, CRISC, or CHPC
• Experience within healthcare technology or digital health
• Success in building and scaling GRC programs in high-growth organizations
• Familiarity with GRC platforms and compliance management tools

About the Company

Commure is building the AI Operating System for healthcare, providing a platform that integrates with over 60 EHRs to automate patient and revenue workflows, reducing the administrative burden on clinicians.