Manager, Security Governance, Risk & Compliance

IQVIA•Durham, NC

22h•$90,200 - $225,600

About The Position

The Manager, Security Governance, Risk & Compliance is a hands-on program leadership role supporting Cedar Gate Technologies’ security governance, risk, and compliance program. The role reports to the Associate Director responsible for Cedar Gate security and partners with that leader to operate and mature a program that supports client trust, audit commitments, and revenue. Cedar Gate maintains SOC 1, SOC 2, and HITRUST r2 certifications and handles ongoing client security reviews, questionnaires, and audit requests. The manager oversees recurring compliance controls performed largely by an operations team in Nepal and leads related programs covering audit administration, customer assurance, enterprise risk, business continuity, policy, and third-party risk. A near-term priority is rebuilding and maturing the enterprise risk program, including interview-driven risk assessments, business impact analyses, disaster recovery planning, and risk exception management. As Cedar Gate integrates with IQVIA, the manager will help align Cedar Gate’s program with IQVIA security and compliance frameworks and contribute to the broader Information Security organization. The role works with Cedar Gate IT, product, business operations, leadership, the Nepal operations team, external auditors, and clients. IQVIA is a global provider of clinical research services, commercial insights, and healthcare intelligence for the life sciences and healthcare industries. It aims to connect these capabilities to support development and commercialization of medical treatments and improve patient outcomes and population health. IQVIA is an equal opportunity employer and states that application information and credentials must be truthful and complete.

Requirements

5–8 years of experience in security governance, risk and compliance, IT audit, or security compliance roles.
Hands-on experience administering SOC 1 and SOC 2 audits, including evidence management, auditor coordination, and control owner walkthroughs.
Hands-on experience with HITRUST CSF assessments; r2 and interim assessment experience is preferred within the requirement description.
Experience operating or testing IT general controls, including access reviews, termination and elevated access processes, patch management, backup, and data destruction.
Experience building or maturing an enterprise or IT risk management program, including risk registers, interview-based risk assessments, exception processes, and remediation tracking.
Experience with business impact analysis, business continuity, and disaster recovery planning.
Experience supporting customer assurance activities such as security questionnaires, client audits, and SOC report distribution.
Experience with third-party risk management and vendor security assessments.
Working knowledge of HIPAA/HITECH requirements and PHI handling controls.
Experience overseeing work performed by offshore or distributed teams without direct reporting lines, including quality review, follow-up, and escalation.
Familiarity with cloud environments, preferably AWS, and common security controls such as DLP and endpoint protection.
Strong organizational and program management skills, including the ability to run a recurring control calendar and multiple concurrent audits against firm deadlines.
Ability to work credibly with executives, auditors, clients, and control owners and drive decisions on sensitive findings and risk treatment.

Nice To Haves

Experience in healthcare, health technology, or another regulated environment.
Bachelor’s degree in Information Security, Information Systems, Business, or equivalent practical experience.
Relevant certifications such as CISA, CISSP, CRISC, or HITRUST CCSFP.

Responsibilities

Partner with the Associate Director to plan, execute, and report on Cedar Gate security governance, risk, and compliance workstreams, including compliance, audit, risk, and customer assurance.
Administer annual SOC 1 and SOC 2 audits and HITRUST r2 and interim assessments; coordinate evidence requests, interviews, and walkthroughs, and drive gap resolution and escalations.
Manage audit vendor relationships with the Associate Director, including vendor selection, contracts, deliverables, and payment.
Oversee the quality and execution of recurring controls performed by the Nepal operations team, including logical and physical access reviews, termination reviews, elevated access reviews, backup validation, patching compliance audits, and the annual facility security audit; identify gaps and escalate them through resolution.
Oversee data protection controls, including monthly data destruction sample audits, review and issuance of client data destruction certificates, and DLP reviews of PHI activity across AWS WorkSpaces users.
Support client security reviews, questionnaires, and audit communications, including executing SOC 2 NDAs and distributing SOC reports to clients and prospects.
Mature the enterprise risk program by maintaining the risk register, leading interview-based risk assessments, managing risk exceptions, and tracking treatment and remediation plans with accountable owners.
Provide Cedar Gate and IQVIA leadership with regular reporting on risk register changes, results, trends, control effectiveness metrics, and audit status.
Lead the annual business impact analysis and maintain business continuity and disaster recovery plans; assess new products and update plans for existing products.
Develop, review, and update security policies and procedures with the Associate Director, coordinating stakeholder input and approvals.
Oversee third-party risk management for Tier 1 Cedar Gate vendors, including annual reviews of vendor security posture.
Coordinate same-day responses to significant audit findings, emerging security risks, compliance issues, and customer-driven requests across stakeholders.
Support integration by aligning Cedar Gate controls, policies, and evidence processes with IQVIA frameworks and contributing to broader IQVIA governance, risk, and compliance initiatives.