Global Risk Compliance

Hippocratic AI•Menlo Park, CA

About The Position

Hippocratic AI is seeking a GRC Program Lead to own and scale its governance, risk, and compliance program. Reporting to the CISO, this role is the central point of contact for certifications and attestations, customer security assurance, U.S. and international data privacy, regulatory and AI governance initiatives, and enterprise risk management. The role works across Sales, Engineering, DevOps, Clinical, and Legal to maintain a compliance posture that meets the needs of health systems, payors, pharmaceutical and life-science partners, federal customers, and international markets. The lead oversees compliance frameworks and certifications including SOC 2, HITRUST, HIPAA, and ISO 42001; supports international privacy and regulatory readiness; manages risk and privacy programs; and leads external audits and customer security assessments. The role also maintains compliance policies, audit dashboards, the public trust center, metrics and reporting, and targeted training to build a culture of compliance.

Requirements

Bachelor's degree.
At least 5 years of experience in GRC, compliance, or audit, ideally in a healthcare or payor environment.
Strong working knowledge of healthcare regulations and frameworks, including HIPAA, HITRUST, SOC 2, and ISO 42001.
Working knowledge of international data protection and privacy law, including GDPR, UK GDPR, cross-border transfers, and data residency, and experience translating requirements into operational controls.
Hands-on experience with customer security assessments, TPRM portals, and GRC or trust-center tools such as Vanta.
Experience leading risk assessments, audits, vendor risk reviews, and compliance reviews.
Strong analytical, problem-solving, and communication skills.
Ability to explain complex security and compliance topics clearly to customers, executives, and non-technical audiences.
Startup experience and comfort operating with ambiguity and minimal supervision.
Detail-oriented, organized, and adaptable, with high integrity, discretion, and ethical standards.
Ability to collaborate effectively across clinical, administrative, and technical teams.

Nice To Haves

CISM, CRISC, CHPC, or similar certifications.
Experience with FedRAMP High, GovCloud, and NIST SP 800-53 / 800-171, including authorization or readiness efforts for federal customers.
Experience in a pharma or life-science environment, including GxP, GAMP 5, CSV, 21 CFR Part 11, and ALCOA+ quality and validation frameworks, and exposure to SaMD or ISO 13485.
Privacy certifications such as CIPP/E, CIPP/US, or CIPM.
Experience with ISO 27001 / 27701 and familiarity with emerging AI governance regulations such as the EU AI Act.

Responsibilities

Maintain SOC 2, HITRUST, and HIPAA Privacy and Security attestations, including expansion of SOC 2 Trust Services Criteria, data de-identification standards, and applicable CMS regulations and federal guidelines.
Implement and manage the ISO 42001 AI Management System, drive gap remediation, and work toward a certification audit targeted for 2027.
Lead readiness and compliance work for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, data residency, and local healthcare and AI regulations.
Monitor and operationalize emerging state, federal, and international obligations as they apply to the business.
Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence.
Draft, update, and communicate internal and external compliance policies.
Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and conduct quarterly risk reviews.
Conduct third-party and fourth-party compliance and risk assessments.
Lead Data Protection Impact Assessments, internal privacy reviews, data residency and regulatory analysis, and privacy documentation for U.S. and international jurisdictions.
Conduct AI governance reviews against emerging laws and regulations and translate requirements into program controls.
Lead external audits and customer security assessments; manage security questionnaires, RFP responses, customer calls, and follow-ups, using AI-assisted drafting with rigorous human review.
Conduct and oversee customer annual assessments and renewals, focusing on payor-side compliance requirements and provider third-party risk management portals.
Deliver customer-facing and internal presentations, including customer security reviews, sales support calls, executive briefings, and team training sessions.
Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current, and program-manage internal non-compliance remediation.
Build and maintain metrics and reporting to measure program effectiveness and improve security maturity, including leadership reports and tabletop exercises.
Design and deliver targeted training on patient privacy, data security, and regulatory requirements, and foster a culture of compliance across clinical, administrative, and technical teams.