Director, IT Security Risk

R1 RCM•Remote, PA, IL

2d•$122,366 - $178,767•Onsite

About The Position

As Director, IT Security Risk, you will lead cybersecurity governance, risk, and compliance capabilities that protect R1 and customer information assets and technology infrastructure. Reporting to the Deputy CISO, you will lead a US- and India-based team and own key programs spanning third-party cyber risk, customer cybersecurity inquiries and assessments, risk exceptions, and the cyber risk register. This is a hands-on leadership opportunity to mature and automate critical cyber risk processes in a dynamic, global healthcare organization. You will partner with customers, business leaders, Procurement, Compliance, IT, Product Development, and Security teams to address risk, support business needs, and strengthen the organization’s overall security posture.

Requirements

Bachelor’s degree or an equivalent combination of education and relevant experience.
10+ years of cybersecurity, technology risk, governance, risk and compliance, or related experience, including at least five years in a people-management role.
Demonstrated experience leading cybersecurity governance, risk, and compliance programs, with significant responsibility for third-party cyber risk management.
Experience building a new cyber GRC or third-party risk capability from the ground up, or materially rebuilding and maturing an existing program.
Experience managing customer cybersecurity questionnaires, risk assessments, exceptions, and risk-register processes.
Experience leading and developing teams across geographies, ideally including US- and India-based employees.
Strong customer-facing and stakeholder-management skills, with the ability to work effectively with senior leaders, business partners, Procurement, Compliance, IT, Product Development, and Security teams.
Ability to translate cybersecurity risk into clear business impact, recommendations, metrics, and executive-level reporting.
Experience improving processes through standardization, workflow design, and automation.
Strong judgment, organization, responsiveness, and the ability to manage multiple priorities and rapid-turnaround requests.

Nice To Haves

Cybersecurity risk experience within healthcare, banking, financial services, or another highly regulated industry.
CISM certification required; CISSP or another relevant cybersecurity or risk certification is strongly preferred.

Responsibilities

Develop and execute the strategy and operating program for assessing, monitoring, and mitigating cybersecurity risk from third parties and suppliers.
Lead, mentor, and develop a US- and India-based team, including approximately two to three direct reports and a broader team of approximately five employees.
Oversee responses to customer cybersecurity questionnaires, customer cyber risk assessments, risk-exception processing, and maintenance of the cyber risk register.
Build and mature scalable governance and third-party risk capabilities, including clear procedures, documentation, controls, reporting, and stakeholder accountability.
Continuously review and optimize processes for efficiency and effectiveness in a changing threat environment, leveraging automation wherever appropriate.
Partner with customers and internal relationship leaders to respond to cybersecurity inquiries and support time-sensitive business needs.
Collaborate with IT, Product Development, Procurement, Compliance, business leaders, and other Security teams to reduce risk and address customer, contractual, regulatory, and operational requirements.
Ensure alignment with applicable regulatory requirements, industry standards, company policies, and cybersecurity best practices.
Develop and maintain program procedures, standards, and supporting documentation.
Define and communicate program performance, risk trends, priorities, and recommendations to senior management and other stakeholders.
Stay current on industry trends, emerging threats, and evolving cybersecurity governance and third-party risk practices.
Foster a culture of security awareness, accountability, collaboration, and continuous improvement.
Manage relationships with external partners, including security vendors and consultants.