Manager, Governance, Risk & Compliance in ROCHESTER, New York at Rochester Regional Health

Job Title: Governance Risk & Compliance Manager

Department: Information Security

Location: Remote, United States

Schedule: Days, Monday - Friday

SUMMARY

The Governance, Risk & Compliance [GRC] Manager at ACM Global Laboratories translates strategic direction into actionable workflows, coordinates cross-functional teams, supports evidence lifecycle management, maps frameworks to control implementation, leads readiness activities, and ensures all ACM GRC processes operate smoothly and efficiently.

RESPONSIBILITIES

• Leads the GRC program activities and a team of professionals related to third-party risk, security internal audit, security compliance, and ISMS program management.

• Develop, document, and implement internal policies and procedures to ensure compliance with industry standards and legal requirements.

• Facilitate regular risk assessments against security frameworks such as SOC 2, ISO 27001, and PCI-DSS, maintain a risk register, and collaborate on mitigation strategies for identified threats. Manage CAPAs for non-compliance.

• Define specific, assignable actions to mitigate the identified risks or exploit the opportunities.

• Evaluate how to embed the planned actions directly into daily operational processes.

• Manage security responses to client questions and questionnaires, including RFPs, RFIs, annual risk reviews, and ad-hoc communication requests.

• Manage and update business continuity and disaster recovery documentation, including BIAs, plan revisions, team rosters, and dependencies. Plan, coordinate, and document annual exercises, such as tests, tabletops, and other exercises.

• Build and manage a security metrics (KPI’s) program.

• Develop relationships with cross-functional teams, understanding their needs in relation to security standards, to drive risk-informed decision-making and build a culture of compliance.

• Provide expert guidance and support in navigating complex regulatory environments in relation to the management of alignment to ISO-27001 and other applicable security frameworks.

• Stay updated on applicable industry trends and regulations to ensure ISMS compliance.

• Monitor and analyze GRC processes and systems, making recommendations for improvement.

• Document risk reduction plan. Annually, document “Opportunities” (potential positive improvements like adopting some technology for improved efficiency).

• Other duties as assigned.

REQUIRED QUALIFICATIONS

• Minimum of 5 years of experience leading Governance, Risk, and Compliance (GRC) programs.

• Proficiency in ISO 27001

PREFERRED QUALIFICATIONS

• GRC certifications (e.g. CGRC, CRISC, etc)

• A bachelor’s degree in IT, cybersecurity, business, or law is preferred, or strong demonstrable background in GRC Management.

• Previous experience in GRC, risk management, or internal audit, often with a mid-level leadership background.

• Proficiency in frameworks like SOC2, NIST CSF, and HIPAA regulations.

• Strong ability to analyze risk data and translate complex regulations into actionable controls.

• Excellent communication skills to interact with stakeholders and lead team efforts.

• Experience with 3rd party/vendor risk management processes.

• Experience in working with sales teams to complete Requests for Proposals and security questionnaires.

• Understanding of GRC processes such as policy management, risk assessment, and IT audits.

• Exceptional verbal and written communication skills.

PHYSICAL REQUIREMENTS: L - Light Work - Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly; requires occasional walking, standing or squatting.

PAY RANGE: $115,000.00 - $140,000.00

The listed base pay range is a good faith representation of current potential base pay for successful applicants. It may be modified in the future. Pay is determined by factors including experience, clinical licensure date, relevant qualifications, specialty, internal equity, location, and contracts.