Governance Risk Compliance

About the Role Hippocratic AI is looking for a GRC Program Lead to own and scale our governance, risk, and compliance program. Reporting to the CISO, you will be the central point of contact for certifications and attestations (SOC 2, HITRUST, HIPAA, ISO 42001), customer security assurance, U.S. and international data privacy, regulatory and AI governance initiatives, and enterprise risk management. You will work across Sales, Engineering, DevOps, Clinical, and Legal teams to keep our compliance posture ahead of the demands of health systems, payors, pharma and life-science partners, federal customers, and new international markets. Responsibilities Certifications, Frameworks & Compliance Programs - Framework and certification oversight: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de-identification standards and applicable CMS regulations and federal guidelines. - ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027. - International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, in-country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act) as we enter new markets. - Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC) as they apply to our business. - Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence. - Policy management: Draft, update, and communicate internal and external compliance policies. Risk, Privacy & Governance - Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and run quarterly risk reviews. - Vendor risk: Execute third-party (and fourth-party) compliance and risk assessments. - Data privacy: Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, data residency and regulatory analysis, and privacy documentation (records of processing, data maps, privacy notices) for U.S. and international jurisdictions. - AI governance: Conduct governance reviews against emerging AI laws and regulations and translate requirements into program controls. Audit, Assurance & Program Operations - Audits and customer assessments: Serve as the lead and central point of contact for external audits and customer security assessments; manage and execute security questionnaires, RFP responses, customer calls, and follow-ups, pairing AI-assisted drafting with rigorous human review. - Annual assessments and renewals: Conduct and oversee customer annual assessments and renewals, with a focus on payor-side compliance requirements and provider third-party risk management (TPRM) portals. - Presentations: Deliver customer-facing and internal presentations on our security and compliance program, including customer security reviews, sales support calls, executive briefings, and team training sessions. - Trust center and dashboards: Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current; program-manage internal non-compliance processes through remediation. - Metrics and reporting: Build and maintain a metrics and reporting framework that measures program effectiveness and raises security maturity, including clear, actionable leadership reports and tabletop exercises. - Training and culture: Design and deliver targeted training on patient privacy, data security, and regulatory requirements; foster a culture of compliance across clinical, administrative, and technical teams. Qualifications & Skills - AI skillset and examples of use - Bachelor's degree; CISM, CRISC, CHPC, or similar certifications preferred. - 5+ years in GRC, compliance, or audit, ideally in a healthcare or payor environment. - Strong working knowledge of healthcare regulations and frameworks, including HIPAA, HITRUST, SOC 2, and ISO 42001. - Working knowledge of international data protection and privacy law (GDPR and UK GDPR, cross-border transfers, data residency) and experience translating it into operational controls. - Hands-on experience with customer security assessments, TPRM portals, and GRC or trust-center tooling (e.g., Vanta). - Proven experience leading risk assessments, audits, vendor risk reviews, and compliance reviews, with strong analytical, problem-solving, and communication skills. - Confident presenter able to explain complex security and compliance topics clearly to customers, executives, and non-technical audiences. - Startup experience; comfortable operating with ambiguity and minimal supervision. - Detail-oriented, organized, and adaptable, with high integrity, discretion, and ethical standards; collaborates effectively across clinical, administrative, and technical teams. Nice to Have - Experience with FedRAMP High, GovCloud, and NIST SP 800-53 / 800-171, including authorization or readiness efforts for federal customers. - Experience in a pharma or life-science environment, including quality and validation frameworks such as GxP, GAMP 5, CSV, 21 CFR Part 11, and ALCOA+, and exposure to SaMD or ISO 13485. - Privacy certifications (CIPP/E, CIPP/US, CIPM), experience with ISO 27001 / 27701, and familiarity with emerging AI governance regulations such as the EU AI Act. WHY JOIN HIPPOCRATIC AI Reinvent healthcare with AI that puts safety first. We’re building the world’s first healthcare‑only, safety‑focused LLM — a breakthrough platform designed to transform patient outcomes at a global scale. This is category creation. Work with the people shaping the future. Hippocratic AI was co‑founded by CEO Munjal Shah and a team of physicians, hospital leaders, AI pioneers, and researchers from institutions like El Camino Health, Johns Hopkins, Washington University in St. Louis, Stanford, Google, Meta, Microsoft, and NVIDIA. Backed by the world’s leading healthcare and AI investors. We recently raised a $126M Series C at a $3.5B valuation, led by Avenir Growth, bringing total funding to $404M with participation from CapitalG, General Catalyst, a16z, Kleiner Perkins, Premji Invest, UHS, Cincinnati Children’s, WellSpan Health, John Doerr, Rick Klausner, and others. Build alongside the best in healthcare and AI. Join experts who’ve spent their careers improving care, advancing science, and building world‑changing technologies — ensuring our platform is powerful, trusted, and truly transformative. EQUAL OPPORTUNITY Hippocratic AI is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, national origin, sex, age, disability, sexual orientation, gender identity or expression, genetic information, military or veteran status, or any other characteristic protected by applicable law. We are committed to building a team that reflects the patients we serve. We actively encourage applications from candidates of all backgrounds. If you require accommodations during the hiring process, please contact people@hippocraticai.com. Please be aware of recruitment scams impersonating Hippocratic AI. All recruiting communication will come from @hippocraticai.com http://hippocraticai.com email addresses. We will never request payment or sensitive personal information during the hiring process.