IT Risk and Compliance Manager

University of Colorado•Hybrid, CO

2d•$92,804 - $120,000•Hybrid

About The Position

The University of Colorado Anschutz Department of Information Strategy and Services (ISS) is seeking an IT Risk and Compliance Manager to lead university-wide IT risk and compliance operations supporting the University of Colorado Anschutz Medical Campus and the University of Colorado Denver. The role combines people leadership, technical expertise, strategic planning, and partnership to protect university data and technology while supporting university missions. The manager leads the IT Risk and Compliance team and helps ensure compliance with requirements including HIPAA, FERPA, PCI, and FISMA. The position is hybrid and requires at least three days per week on campus, with additional in-person attendance as needed for meetings, collaboration, and operational needs. The work schedule is based around core working hours in Colorado Mountain Time. The anticipated starting salary range is $92,804–$120,000. The role may be eligible for overtime compensation depending on its level. The minimum qualifications include a bachelor's degree in a related field, with specified experience substitutions available, 4–6 years of relevant experience, and two years of management experience. Applicants must be legally authorized to work in the United States without current or future sponsorship. Applications are reviewed beginning immediately and continue until the position is filled; the best-consideration date is November 18, 2026.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Engineering, Business, Education, or a closely related field. Four years of professional or high-level technical work experience may substitute for the bachelor’s degree; an associate’s degree plus two years of relevant work experience may also substitute.
4–6 years of relevant experience in information technology, information security, risk management, regulatory compliance, or related functions.
Experience with third-party technology risk management and security assessments of university-operated or vendor-provided systems, applications, cloud services, or emerging technologies, including contractual security compliance.
Experience collaborating on cross-functional IT security, risk, or compliance projects.
Experience implementing or administering GRC platforms, workflow automation, reporting dashboards, or related technologies.
Experience administering or supporting IT risk and compliance functions in higher education, academic research, healthcare, an academic medical center, or a similarly complex environment, including collaboration with faculty, researchers, healthcare professionals, administrators, or other clientele.
Two years of management experience, including responsibility for leading professional or technical staff, managing priorities and workloads, and overseeing team operations and performance.
Applicants must meet minimum qualifications at the time of hire.
Applicants must be legally authorized to work in the United States without requiring sponsorship; the university cannot provide work visa sponsorship or employment authorization now or in the future.
Strong leadership and operational management skills, including team development, performance management, workload planning, and service oversight.
Advanced knowledge of IT risk management, information security, regulatory compliance, security controls, and risk mitigation.
Experience interpreting and applying requirements such as HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC.
Ability to translate technical, regulatory, and risk information into clear, practical guidance for varied audiences.
Strong analytical, communication, decision-making, project management, and relationship-building skills.
Collaborative, accountable, and service-oriented leadership approach focused on technical excellence and continuous improvement.

Nice To Haves

Experience managing IT risk, information security, or compliance programs or services within a large, complex organization, preferably in higher education, academic research, healthcare, or an academic medical center.
Experience developing, administering, or managing HIPAA Security compliance programs and applying HIPAA Security requirements within information security, IT risk management, or compliance functions.
Experience establishing, administering, or maintaining PCI DSS or other regulatory compliance programs.
Experience with third-party technology risk, security assessments, and cross-functional IT security or compliance initiatives, including collaboration with technical and non-technical stakeholders.
Experience implementing or administering GRC platforms, workflow automation, reporting dashboards, or related technologies.
Experience developing and maintaining information security policies, standards, procedures, and related compliance documentation.
Experience supporting federally funded research, regulated research data, or secure computing environments.
Relevant professional certification such as CISSP, CISA, CISM, CRISC, CGRC, HCISPP, GIAC, or a comparable security, risk management, audit, or compliance certification.

Responsibilities

Lead and develop a team of IT risk and compliance professionals, setting priorities, managing workloads and performance, and supporting professional growth.
Lead the university’s IT risk and compliance program, including risk assessments, regulatory compliance, policy development, monitoring, reporting, and continuous improvement.
Oversee risk and compliance assessments for university and third-party systems, applications, cloud services, AI technologies, and other technologies, documenting risks, requirements, controls, and recommended treatments.
Build partnerships across the university to identify and address IT risk and compliance needs with researchers, healthcare partners, technology teams, legal counsel, privacy, procurement, administrators, and other stakeholders.
Strengthen technology and vendor security practices, including reviewing contracts and cloud service agreements and addressing security requirements and identified risks.
Modernize IT risk and compliance services by implementing GRC tools, improving workflows, and using monitoring, metrics, and reporting to improve service delivery.

Benefits

Health insurance, with multiple medical plan options
Life insurance
Retirement plans, including a 401(a) plan with an employer contribution of 10% of gross pay
Tuition benefits available on all CU campuses
Paid vacation, sick leave, and holidays
Disability insurance
Vision insurance
Reduced-rate ECO Pass for RTD bus and light rail service
Workforce development program supporting skill building and career advancement
Wellness initiatives
Flexible work arrangements when possible
Additional perks and programs through CU Advantage