Governance, Risk, and Compliance (GRC) Lead at Hippocratic AI in Menlo Park, CA

Job description

About the Role Hippocratic AI is looking for a GRC Program Lead to own and scale our governance, risk, and compliance program. Reporting to the CISO, you will be the central point of contact for certifications and attestations (SOC 2, HITRUST, HIPAA, ISO 42001), customer security assurance, U.S. and international data privacy, regulatory and AI governance initiatives, and enterprise risk management. You will work across Sales, Engineering, DevOps, Clinical, and Legal teams to keep our compliance posture ahead of the demands of health systems, payors, pharma and life-science partners, federal customers, and new international markets. Responsibilities Certifications, Frameworks & Compliance Programs • Framework and certification oversight: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de-identification standards and applicable CMS regulations and federal guidelines. • ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027. • International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, in-country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act) as we enter new markets. • Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC) as they apply to our business. • Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence. • Policy management: Draft, update, and communicate internal and external compliance policies. Risk, Privacy & Governance • Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and run quarterly risk reviews. • Vendor risk: Execute third-party (and fourth-party) compliance and risk assessments. • Data privacy: Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, data residency and regulatory analysis, and privacy documentation (records of processing, data maps, privacy notices) for U.S. and international jurisdictions. • AI governance: Conduct governance reviews against emerging AI laws and regulations and translate requirements into program controls. Audit, Assurance & Program Operations • Audits and customer assessments: Serve as the lead and central point of contact for external audits and customer security assessments; manage and execute security questionnaires, RFP responses, customer calls, and follow-ups, pairing AI-assisted drafting with rigorous human review. • Annual assessments and renewals: Conduct and oversee customer annual assessments and renewals, with a focus on payor-side compliance requirements and provider third-party risk management (TPRM) portals. • Presentations: Deliver customer-facing and internal presentations on our security and compliance program, including customer security reviews, sales support calls, executive briefings, and team training sessions. • Trust center and dashboards: Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current; program-manage internal non-compliance processes through remediation. • Metrics and reporting: Build and maintain a metrics and reporting framework that measures program effectiveness and raises security maturity, including clear, actionable leadership reports and tabletop exercises. • Training and culture: Design and deliver targeted training on patient privacy, data security, and regulatory requirements; foster a culture of compliance across clinical, administrative, and technical teams. Qualifications & Skills • AI skillset and examples of use • Bachelor's degree; CISM, CRISC, CHPC, or