Cybersecurity GRC Manager, FCH - IT - SECURITY

Froedtert•Menomonee Falls, WI

41d•$49 - $84•Remote

About The Position

The Cybersecurity GRC Manager leads Froedtert ThedaCare’s cybersecurity governance, risk, and compliance program, connecting regulatory and governance requirements to real-world risk outcomes for patients, clinicians, and the communities served across Wisconsin. This high-visibility, high-autonomy leadership role is part of the Cybersecurity & Infrastructure team and is responsible for building and leading a team of 5+ GRC professionals while serving as the organization’s subject matter authority on compliance and risk. The manager oversees HIPAA compliance, enterprise cybersecurity risk management, third-party risk, policy and controls frameworks, audits and assessments, and security awareness and phishing simulation programs. The role translates regulatory requirements and technical risks into actionable programs, executive-level reporting, and business impact language, working with stakeholders across Legal, Privacy, Clinical Operations, and other areas of the organization.

Requirements

At least 6 years of experience in a related field.
Bachelor’s degree required.
In-depth knowledge of cybersecurity frameworks, including NIST CSF, HITRUST CSF, and ISO 27001.
Experience managing or leading security organizations responsible for GRC, cybersecurity, medical device security, or security operations centers.
Understanding of security concepts including cryptography, DLP, security operations centers, security managed services, SEM, firewalls, and audit.
Demonstrated record of managing third-party security services, preferably with cloud providers.
Ability to communicate and represent the IT Security organization with business partners and third-party vendors.
Strong oral, presentation, and writing skills, with a demonstrated record of delivering results.
Ability to build relationships with business stakeholders in the IT Security program.
Familiarity with HIPAA Privacy and Security Rules and their operational implications for a large health system.
Ability to develop and present executive-level risk reporting that communicates risk in business impact terms.
Comfort operating in a matrixed environment involving Legal, HR, IT, Clinical Operations, and executive leadership.

Nice To Haves

3+ years leading or managing a team in a GRC, compliance, or risk management capacity.
Experience in healthcare or another highly regulated industry, with direct exposure to HIPAA compliance obligations.
Experience managing a third-party risk program, including vendor assessments and risk tiering.
Experience building or significantly maturing a GRC program.
Experience managing external audits or assessments such as SOC 2, HITRUST, OCR, or internal audits.
Bachelor’s degree in Computer Science or a similar field.
CISSP, CISM, CRISC, HCISPP, or equivalent certification.
Certified in Healthcare Privacy and Security (CHPS) or equivalent certification.
Experience in the healthcare industry.

Responsibilities

Lead, mentor, and develop a team of 5+ GRC analysts and specialists across compliance, risk, policy, and awareness.
Set role expectations, development pathways, and performance standards for team members, and foster a pragmatic, outcomes-focused team culture.
Serve as the functional lead for HIPAA Privacy and Security Rule compliance, including gap assessments and remediation tracking.
Coordinate with Legal, Privacy, and Clinical Operations to ensure compliance obligations are understood and operationalized across the enterprise.
Oversee preparation for and responses to regulatory inquiries, OCR investigations, and audit activity.
Own the enterprise cybersecurity risk register and ensure risks are identified, assessed, prioritized, and tracked to resolution.
Lead the third-party risk management program, including vendor onboarding assessments, ongoing monitoring, and supply-chain risk tiering.
Develop risk reporting for executive and board audiences, translating technical risk into business impact language.
Own the cybersecurity policy lifecycle, including authorship, review cadence, version control, approval workflows, and exception management.
Maintain alignment with NIST CSF, including control mapping, evidence collection, and measurement of control effectiveness.
Drive continuous improvement of the controls environment based on assessment findings, threat intelligence, and regulatory changes.
Lead and serve as the primary point of contact for internal and external cybersecurity audits and assessments.
Coordinate evidence collection, stakeholder readiness, and finding remediation through closure.
Develop and maintain audit-ready documentation across GRC domains.
Own the enterprise security awareness program, including curriculum development, scheduling, and effectiveness measurement.
Manage the phishing simulation program, including scenario design, cadence, metrics, and targeted follow-up training.
Tailor awareness content for audiences including clinical staff and executive leadership.