Head of IT Governance, Risk, and Compliance (GRC)

LabConnect • Johnson City, TN

3d

About The Position

LabConnect improves lives by partnering with pharmaceutical and biotech companies, and clinical research organizations (CROs) to accelerate the development of new medicines around the world. We are an independent, global, one-stop-shop focused on delivering Central Laboratory Services that are tailor-made, timely and flexible to meet the evolving study demands of traditional to increasingly complex trials. Additionally, we provide Functional Service Provider (FSP) Solutions, supporting our clients with scientific and technical expertise, acting as an extension of their team, coordinating all laboratory related needs, advising on strategies for lab data collection and providing end-to-end analytical and logistical solutions. LabConnect is seeking a senior leader to establish and mature our IT Governance, Risk, and Compliance function — and to lead the organization in using AI itself as the engine of that compliance. This is a build role for a leader who believes that in a GxP environment, controls should be authored, tested, and enforced continuously by intelligent systems rather than rediscovered during an audit. You will own the strategy and operating model that advances compliance across SOC 2, HIPAA, GDPR, and FDA 21 CFR Part 11, while deploying AI and agentic tooling to draft and maintain SOPs, detect compliance gaps across our code and configuration, and enforce regulated-development standards at the point of work. In parallel, you will govern AI adoption responsibly across internal workflows and product development, setting the validation and oversight standards that make AI trustworthy in a healthcare context.

Position Overview:
In this role, you will work closely with teams across infrastructure, security, engineering, data, quality, and operations to make compliance a continuous, largely automated property of how LabConnect builds and operates — not a documentation exercise performed after the fact. You will define the target state for an AI-enabled GxP control environment and the roadmap to reach it: AI-assisted authoring and maintenance of SOPs and controlled documents, automated detection of compliance and validation gaps across code, configuration, and infrastructure, agentic development rules that encode regulated-engineering requirements directly into the tools engineers use every day, and continuous evidence collection that keeps the organization audit-ready by default. At the same time, you will govern the AI systems themselves — establishing the validation, human-oversight, transparency, and monitoring standards required for AI to be used safely in clinical research and healthcare — working in partnership with the Quality team that owns CSV and GxP validation.

Requirements

• Strong leadership experience in IT security, compliance, risk management, or GRC, ideally within a high-growth, cloud-enabled, or highly regulated environment, and you have led change in how compliance work itself gets done.
• Experience putting AI to work on compliance problems, not only governing it from the outside. Experience with AI-assisted authoring of controlled documents, automated control or code scanning, policy-as-code, or agentic development workflows is highly valued — along with the judgment to know which outputs require human review before they carry regulatory weight.
• Strong working knowledge of major security and privacy frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR, along with practical command of AI governance standards including the NIST AI Risk Management Framework and ISO/IEC 42001. Experience applying risk-based controls to AI use cases — privacy safeguards, vendor oversight, auditability, and model governance — is expected.
• Understanding of life sciences, healthcare, or other regulated industries, including GxP, FDA 21 CFR Part 11, computer system validation, and risk-based computer software assurance, and how validation expectations apply when software is written or reviewed with AI assistance.
• Solid understanding of cloud platforms, data governance, identity and access management, endpoint and virtual desktop security, enterprise integration patterns, and modern engineering practice — source control, CI/CD, infrastructure-as-code, and AI coding agents — sufficient to set rules that engineers can follow and that hold up in an audit.
• Comfort communicating complex risk, compliance, and security topics clearly and credibly to senior leaders, auditors, clients, and cross-functional stakeholders — including explaining and defending an AI-enabled approach to compliance to sponsors and regulators.
• 15+ years of progressive leadership experience across IT security, risk, compliance, or GRC, including accountability for a regulated control environment, along with a demonstrated track record of building strong teams and leading meaningful transformation.
• Led successfully at a senior executive or enterprise leadership level, with accountability for compliance strategy, organizational capability, and audit outcomes in complex environments.
• Introduced AI or intelligent automation into compliance, quality, or regulated documentation workflows and carried it through to adoption and auditor acceptance — not just to pilot.
• Hands-on familiarity with modern engineering practice, including source control, CI/CD, infrastructure-as-code, AI-assisted development, and emerging agentic approaches, sufficient to define enforceable rules for how software is built in validated systems.
• Strong grasp of data architecture and data governance, including relational, unstructured, blob, and vector-based data models, and the control considerations that follow when that data feeds AI-enabled solutions.
• Significant experience in Microsoft Azure environments, including platforms such as Purview, Entra ID, Defender, Azure Data Lake, and Azure AI services.
• Demonstrated record of audit and inspection success across frameworks such as SOC 2, HIPAA, GDPR, or FDA 21 CFR Part 11, and of partnering with engineering leaders to deliver resilient, compliant, and scalable solutions without stalling delivery.

Nice To Haves

• Advanced degree is a plus.
• Experience in regulated industries such as healthcare, life sciences, clinical research, or similarly complex operational environments is strongly preferred.

Responsibilities

• Lead LabConnect’s shift from periodic, manual compliance work to continuous, AI-assisted compliance. This includes deploying AI to draft, revise, and maintain SOPs, work instructions, and controlled documentation against current regulation and actual practice; keeping the SOP register, change history, and training impact current; and surfacing drift between what our procedures say and what our systems actually do.
• Establish the capability to scan code, configuration, infrastructure-as-code, pipelines, and system documentation for compliance and validation gaps — Part 11 controls such as audit trails, electronic signature, access control, and record retention; privacy and PHI handling; and change-control evidence — surfacing findings continuously to engineering teams rather than at audit time.
• Define and enforce the guardrails that govern AI-assisted and agentic software development in a regulated environment: repository-level rule sets that encode regulated-engineering requirements into the coding agents themselves, mandatory human review and approval gates, traceability from requirement to code to test evidence, explicit boundaries on autonomous agent action in validated systems, and automated checks that block non-compliant changes before they merge.
• Own the governance framework, review process, and risk controls for LabConnect’s AI-first internal workflows and AI-enabled product capabilities. This includes acceptable-use standards, model and vendor oversight, data handling, human-in-the-loop requirements, auditability, validation of AI outputs that carry regulatory or clinical weight, and ongoing monitoring for drift — aligned to HIPAA, the NIST AI Risk Management Framework, ISO/IEC 42001, EU AI Act considerations, and FDA expectations for AI in regulated healthcare settings.
• Assess LabConnect’s current controls, documentation, and operating practices across frameworks such as SOC 2, HIPAA, GDPR, and FDA 21 CFR Part 11, then shape the strategy, roadmap, and governance processes needed to strengthen compliance maturity — with automated evidence collection and continuous control monitoring replacing manual audit preparation wherever it can be defended to an auditor.
• Help define and guide governance, risk, and compliance practices for modern access, endpoint, and virtual desktop environments, including secure approaches that support remote work and bring-your-own-device models.
• Strengthen data protection practices, including classification, monitoring, and loss prevention controls, with particular attention to what data may enter prompts, model training, and agent context windows across collaboration, engineering, and operational platforms.
• Evaluate and monitor the security and compliance posture of external partners, vendors, and service providers — including AI model providers, agentic development tooling, and AI features embedded in platforms we already run — that support important business and regulated processes.
• Partner closely with technology and business leaders to embed compliance, validation, and risk management into delivery in a way that supports both operational rigor and speed. You will work alongside the Quality team, which owns CSV and GxP validation, to ensure that IT controls, automated evidence, and AI-assisted documentation are accepted as validation-grade and aligned with FDA 21 CFR Part 11 and risk-based computer software assurance expectations.

Benefits

• Competitive base salary aligned to experience
• Annual incentive opportunity through the company’s bonus plan
• Comprehensive benefits package
• Financial Security (Base Pay, 401k Match and Possible Annual Bonus Eligibility)
• Health Benefits beginning on date of hire
• PTO plan, plus 11 Paid Company Holidays, and 1 Day to Volunteer in your community
• Short and Long-Term Disability, Life Insurance, and AD&D

What This Job Offers

• Job Type: Full-time
• Career Level: Senior