IT Security Supervisor, GRC

UCSF • San Francisco, CA

7d • $150,000 - $220,000

About The Position

The IT Security Supervisor, GRC, supports the Head of Governance, Risk, and Compliance and the Manager of Cyber Risk Management with expert knowledge of cybersecurity risk management, contractual and regulatory compliance, and security control frameworks. The role analyzes and manages institution-wide security risks across UCSF Health, Campus, Foundation, and affiliated environments, and serves as the functional leader for the GRC team, directing day-to-day enterprise cyber risk and compliance services.

The position provides sustained staff direction, work prioritization, mentoring, training, escalation handling, and quality oversight across complex risk assessments—including assessments of AI solutions—security exceptions, policy interpretation, contract reviews, third-party reviews, and enterprise compliance activities. Relevant compliance areas include PCI-DSS, HIPAA, UC policy, and NIST-based frameworks.

The role leads projects and program improvements with organization-wide impact, including ServiceNow IRM and IT Service Management workflows, metrics, training, quality controls, and operating standards. It uses AI solutions to increase service capacity and accelerate delivery, regularly interfaces with senior stakeholders, auditors, and business owners, and provides expert guidance and operational direction to team members. The position also works with the UC Office of the President and other UC campuses on system-wide initiatives. The proposed IT Security Supervisor 2 classification reflects sustained staff direction, program accountability, and enterprise operational leadership responsibilities.

UCSF Cybersecurity protects against and responds to internal and external threats by monitoring vulnerabilities, risks, and exposures and mitigating issues before exploitation. If an incident occurs, IT Security investigates, determines impact, and recommends controls to reduce the likelihood of recurrence. Its areas of work include vulnerability management, network and data security, security architecture and design review, incident response and forensic analysis, cyber threat intelligence, threat hunting and event analysis, information security policies and standards, security risk assessments, governance, risk and compliance, secure business solution architecture, security awareness, endpoint security, application security, and e-discovery and forensic services.

Requirements

• Bachelor's degree in a related area and/or equivalent experience and training.
• At least five years of progressively responsible experience in cybersecurity, information security, governance, risk and compliance (GRC), or a related field.
• Advanced knowledge of cybersecurity, privacy, and compliance laws, regulations, standards, and policy frameworks relevant to higher education and healthcare, including UC and UCSF policy, PCI DSS, HIPAA Security Rule, NIST frameworks, and audit expectations.
• Experience directing and coordinating technical or risk/compliance staff, including assigning and prioritizing work, setting expectations, coaching, mentoring, training, and reviewing work quality.
• Experience providing day-to-day functional leadership for a security, risk, or compliance program, including operational coordination, issue escalation, quality oversight, and continuous improvement.
• Advanced experience leading security risk assessments, compliance reviews, remediation planning, and risk-based decision-making across healthcare, research, education, implementation, and vendor environments.
• Demonstrated ability to determine, recommend, and communicate courses of action to departments and leadership on IT security, compliance, and risk matters in complex operational environments.
• Experience developing, implementing, and improving security workflows, standards, procedures, metrics, reporting, quality controls, and program documentation.
• Advanced experience with GRC or IRM platforms, risk assessment processes, security exceptions, risk acceptance, audit response, and related compliance activities.
• Advanced ability to analyze complex technical, operational, and compliance issues and develop defensible, risk-based recommendations using sound judgment.
• Broad knowledge of cybersecurity concepts and operating principles, including networks, applications, cloud services, encryption, identity and access management, logging, endpoint security, third-party services, enterprise applications, hardware, software, and vendor IT products.
• Strong written and verbal communication skills, including ability to prepare reports, presentations, guidance, and other materials for varied audiences, including senior leadership.
• Experience interfacing with auditors, assessors, executives, project teams, and cross-functional stakeholders on significant security, compliance, or risk matters.
• Advanced interpersonal, consultative, and influence skills to work effectively with technical and non-technical personnel at all organizational levels and build productive working relationships.

Nice To Haves

• Advanced coursework or training in cybersecurity, risk management, audit, or compliance.
• At least three years of experience supervising, leading, or providing sustained direction to professional staff.
• Knowledge of institutional processes, governance structures, and regulated data environments in higher education and/or healthcare.
• ServiceNow IRM, GRC, or ITSM experience.
• PCI ISA certification.
• CISSP certification.
• CISA or CRISC certification.
• ServiceNow IRM, GRC, or comparable platform certification.

Responsibilities

• Provide functional leadership for the Cyber Risk & Assurance team through daily and weekly stand-ups, one-on-ones, work coordination and prioritization, mentoring, training, escalation management, quality review, and governance cadence support; provide operational decision-making and cross-functional coordination.
• Lead Cyber Risk & Assurance program development and operations, including ServiceNow IRM and related workflow design, standards and procedures, knowledge content, metrics and reporting, roadmap development, training materials, and continuous process improvement.
• Lead and perform complex enterprise cyber risk and compliance assessments across vendor, implementation, research, healthcare, education, enterprise IT, and administrative engagements; determine assessment approaches, analyze findings, recommend mitigations, and guide exceptions, corrective actions, and risk acceptance.
• Serve as UCSF's lead PCI DSS subject matter expert and Internal Security Assessor; direct PCI-related technical compliance activities, annual assessment support, scoping and descope strategy, evidence review, remediation guidance, vendor security review, and coordination with relevant internal and UC stakeholders and assessors.
• Develop and maintain policy, standards, and governance content aligned to UC policy, UCSF security requirements, HIPAA, NIST, PCI DSS, and related frameworks; participate in policy design sessions, compliance readbacks, governance meetings, and leadership advisory discussions.
• Use AI solutions to increase service capacity and accelerate delivery.
• Work with the UC Office of the President and other UC campuses on system-wide initiatives.
• Perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager