IT Risk and Compliance Manager

University of Colorado•Hybrid, CO

2d•$92,804 - $124,358•Hybrid

About The Position

Information Strategy and Services (ISS) at the University of Colorado Anschutz is seeking an IT Risk and Compliance Manager to lead university-wide IT risk and compliance operations supporting the University of Colorado Anschutz Medical Campus and the University of Colorado Denver. The position combines team leadership, technical expertise, strategic planning, and stakeholder partnership to protect university data and technology and support university missions. The manager will lead the IT Risk and Compliance team, reduce university risk, and support compliance with requirements such as HIPAA, FERPA, PCI, and FISMA. The role oversees the IT risk and compliance program, including risk assessments, regulatory compliance, policy development, monitoring, reporting, and continuous improvement. It includes assessing university and third-party systems, applications, cloud services, AI technologies, and other technologies; documenting risks, requirements, controls, and recommended treatments; and strengthening vendor security practices through contract and cloud service agreement reviews. The manager partners with researchers, healthcare partners, technical teams, legal counsel, privacy, procurement, administrators, and other stakeholders, while modernizing services through GRC tools, improved workflows, monitoring, metrics, and reporting. The position is hybrid, with a minimum of three days per week on campus and additional in-person presence as needed. The work schedule is based around core working hours in Colorado Mountain Time. The position may be eligible for overtime compensation depending on its level.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Engineering, Business, Education, or a closely related field; alternatively, four years of professional or high-level technical work experience, or an associate’s degree plus two years of relevant work experience, may substitute for the bachelor’s degree.
Four to six years of relevant experience in information technology, information security, risk management, regulatory compliance, or related functions.
Experience with third-party technology risk management and security assessments of university-operated or vendor-provided systems, applications, cloud services, or emerging technologies, including contractual security compliance.
Experience collaborating on cross-functional IT security, risk, or compliance projects.
Experience implementing or administering GRC platforms, workflow automation, reporting dashboards, or related technologies.
Experience administering or supporting IT risk and compliance functions in higher education, academic research, healthcare, an academic medical center, or a similarly complex environment, including collaboration with faculty, researchers, healthcare professionals, administrators, or other clientele.
Two years of management experience, including leading professional or technical staff, managing priorities and workloads, and overseeing team operations and performance.
Applicants must meet minimum qualifications at the time of hire.
Strong leadership and operational management skills, including team development, performance management, workload planning, and service oversight.
Advanced knowledge of IT risk management, information security, regulatory compliance, security controls, and risk mitigation.
Experience interpreting and applying requirements such as HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC.
Ability to translate technical, regulatory, and risk information into clear, practical guidance for varied audiences.
Strong analytical, communication, decision-making, project management, and relationship-building skills.
Collaborative, accountable, service-oriented leadership approach focused on technical excellence and continuous improvement.
Legally authorized to work in the United States without requiring sponsorship; the employer cannot provide work visa sponsorship or employment authorization now or in the future.

Nice To Haves

Experience managing IT risk, information security, or compliance programs or services within a large, complex organization, preferably in higher education, academic research, healthcare, or an academic medical center.
Experience developing, administering, or managing HIPAA Security compliance programs, including applying HIPAA Security requirements within information security, IT risk management, or compliance functions.
Experience establishing, administering, or maintaining PCI DSS or other regulatory compliance programs.
Experience with third-party technology risk, security assessments, and cross-functional IT security or compliance initiatives, including collaboration with technical and non-technical stakeholders.
Experience implementing or administering GRC platforms, workflow automation, reporting dashboards, or related technologies.
Experience developing and maintaining information security policies, standards, procedures, and related compliance documentation.
Experience supporting federally funded research, regulated research data, or secure computing environments.
Relevant professional certification such as CISSP, CISA, CISM, CRISC, CGRC, HCISPP, GIAC, or a comparable security, risk management, audit, or compliance certification.
Knowledge of creating or managing a HIPAA security compliance program.
Knowledge of establishing and maintaining a PCI DSS compliance program.
Knowledge of developing information security policies, standards, and procedures.
Knowledge of supporting federally funded research, regulated research data, or secure computing environments.
Technical knowledge of information security principles, enterprise technologies, security controls, vulnerabilities, and risk mitigation practices.
Experience applying IT security and compliance principles in operational technology environments, evaluating security controls, identifying risks, and recommending practical remediation.
Knowledge of regulatory requirements and security frameworks, including FERPA, HIPAA, GLBA, PCI DSS, NIST SP 800-171, NIST SP 800-53, FISMA, and CMMC.
Experience conducting and overseeing IT risk assessments, compliance analyses, risk registers, compliance monitoring, and audit tracking.
Knowledge of regulated research environments, sensitive data requirements, and secure computing practices.
Knowledge of GRC platforms and experience evaluating tools that support risk assessments, compliance management, reporting, and operational efficiency.
Project management, process modernization, and organizational change-management skills.
Analytical, communication, problem-solving, and decision-making skills, including the ability to align risk and compliance activities with university, IT, and Information Security and Compliance program goals.

Responsibilities

Lead and develop the IT risk and compliance team, including setting priorities, managing workloads and performance, and supporting professional growth.
Lead the university’s IT risk and compliance program, including risk assessments, regulatory compliance, policy development, monitoring, reporting, and continuous improvement.
Oversee risk and compliance assessments for university and third-party systems, applications, cloud services, AI technologies, and other technologies; document risks, requirements, controls, and recommended treatments.
Build partnerships across the university to identify and address IT risk and compliance needs with researchers, healthcare partners, technology teams, legal counsel, privacy, procurement, administrators, and other stakeholders.
Strengthen technology and vendor security practices, including reviewing contracts and cloud service agreements and addressing security requirements and identified risks.
Modernize IT risk and compliance services by implementing GRC tools, improving workflows, and using monitoring, metrics, and reporting to improve service delivery.
Maintain organized and current compliance programs, policies, assessments, risk registers, and reporting aligned with university and ISS priorities.
Provide practical, timely guidance to university stakeholders about technology risks and compliance requirements.
Ensure security and compliance risks are identified, documented, assigned, monitored, and addressed.

Benefits

Health insurance, with multiple plan options.
Life insurance.
Disability insurance.
Vision insurance, with multiple plan options.
Retirement plan: the employer contributes 10% of gross pay to the 401(a) plan.
Paid time off, including vacation, sick leave, and holidays.
22 vacation days per year, with a maximum accrual of 352 hours.
15 sick days per year, with unlimited maximum accrual.
15 holiday days per year.
Tuition benefits available on all CU campuses.
Reduced-rate ECO Pass for RTD bus and light rail service.
Workforce Development Program supporting skills development and career advancement.
Wellness initiatives.
Flexible work arrangements whenever possible.
Additional perks and programs through CU Advantage.