Director, Cybersecurity Compliance

About the role

The Director of Cybersecurity Compliance leads the governance, risk and compliance (GRC) program for a healthcare organization. This senior position ensures that cybersecurity controls meet regulatory, audit and patient‑privacy requirements while supporting uninterrupted patient care.

Key responsibilities

• Define and maintain regulatory requirements (HIPAA, HITECH) and security frameworks (NIST, HITRUST, ISO).
• Establish and oversee risk‑management processes and audit practices.
• Independently assess the effectiveness of cybersecurity controls and identify gaps.
• Provide unbiased oversight of security implementations across cybersecurity and IT teams.
• Collaborate with cybersecurity operations, clinical leadership, legal and compliance to embed security into clinical workflows.
• Guide breach response and PHI handling procedures.

Required profile

• Bachelor’s degree in Information Security, IT, Healthcare Administration or related field (Master’s preferred).
• 10+ years of experience in IT security, risk or compliance, with at least 5 years in a leadership role within healthcare or a regulated environment.
• Professional certifications such as CISSP, CISM, CISA, CRISC, HCISPP or HITRUST CCSFP preferred.

Required skills

• Deep knowledge of HIPAA/HITECH compliance.
• Experience with NIST, HITRUST and ISO 27001 security frameworks.
• Proficiency in risk‑management methodologies and audit practices.
• Hands‑on experience with GRC platforms and compliance tooling.
• Strong understanding of PHI handling, privacy requirements and breach response.