SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Hippocratic AI, a healthcare-focused AI company backed by $404M in funding (Series C at $3.5B valuation), is seeking a GRC Program Lead to own and scale its governance, risk, and compliance program. Reporting to the CISO, you will serve as the central point of contact for certifications, attestations, customer security assurance, data privacy, regulatory compliance, and AI governance initiatives.
Key Responsibilities:
Certifications & Compliance Programs: Maintain SOC 2, HITRUST, and HIPAA Privacy and Security attestations. Implement and manage the ISO 42001 AI Management System (AIMS) with certification targeted for 2027. Lead international data compliance workstreams for GDPR, UK GDPR, cross-border transfers, data residency requirements, and emerging regulations like the EU AI Act. Drive GovCloud and FedRAMP High / NIST SP 800-171 authorization efforts. Draft and update internal and external compliance policies.
Risk, Privacy & Governance: Partner with the CISO to identify, assess, and prioritize IT and security risks; maintain the risk framework and conduct quarterly risk reviews. Execute third-party and fourth-party compliance and risk assessments. Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, and privacy documentation for U.S. and international jurisdictions. Conduct governance reviews against emerging AI laws and translate requirements into program controls.
Audit, Assurance & Program Operations: Serve as lead for external audits and customer security assessments; manage security questionnaires, RFP responses, and customer calls. Oversee annual assessments and renewals with focus on payor-side compliance and third-party risk management (TPRM) portals. Deliver customer-facing and internal presentations on security and compliance. Own audit dashboards and the public trust center (Vanta). Build metrics and reporting frameworks to measure program effectiveness. Design and deliver training on patient privacy, data security, and regulatory requirements.
You will work across Sales, Engineering, DevOps, Clinical, and Legal teams to keep compliance posture ahead of demands from health systems, payors, pharma and life-science partners, federal customers, and new international markets.
Requirements:
- Bachelor's degree; CISM, CRISC, CHPC, or similar certifications preferred
- 5+ years in GRC, compliance, or audit, ideally in healthcare or payor environment
- Strong working knowledge of healthcare regulations and frameworks (HIPAA, HITRUST, SOC 2, ISO 42001)
- Working knowledge of international data protection and privacy law (GDPR, UK GDPR, cross-border transfers, data residency) and experience translating into operational controls
- Hands-on experience with customer security assessments, TPRM portals, and GRC/trust-center tooling (e.g., Vanta)
- Proven experience leading risk assessments, audits, vendor risk reviews, and compliance reviews with strong analytical, problem-solving, and communication skills
- Confident presenter able to explain complex security and compliance topics to customers, executives, and non-technical audiences
- Startup experience; comfortable operating with ambiguity and minimal supervision
- Detail-oriented, organized, adaptable, with high integrity and discretion; collaborates effectively across teams
- AI skillset and examples of use
Nice to Have:
- Experience with FedRAMP High, GovCloud, NIST SP 800-53/800-171, including authorization efforts for federal customers
- Experience in pharma or life-science environment, including GxP, GAMP 5, CSV, 21 CFR Part 11, ALCOA+, SaMD, or ISO 13485
- Privacy certifications (CIPP/E, CIPP/US, CIPM), ISO 27001/27701 experience, familiarity with EU AI Act and emerging AI governance regulations
