Director of Governance and Compliance

*This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

The Director of Governance and Compliance leads the strategic development, implementation, and oversight of a comprehensive compliance, privacy, governance, and risk management framework aligned with corporate business objectives, regulatory requirements, and industry best practices.

This role is responsible for ensuring organizational operations and practices comply with applicable state, federal, and international laws, regulations, contractual obligations, and industry standards while effectively identifying, assessing, and mitigating organizational risk.

The Director of Governance and Compliance partners closely with the Director of Information Security and cross-functional business leaders to integrate compliance initiatives with broader security, operational, and business strategies.

• Maintain a current understanding of business activities and applicable state, federal, and international laws and regulations.
• Serve as the organization’s subject matter expert for governance, compliance, privacy, and regulatory requirements.
• Ensure regulatory requirements and compliance practices are incorporated into business initiatives throughout the development lifecycle.
• Identify, plan, prioritize, and manage organizational compliance and privacy activities based on risk.
• Develop and maintain an annual compliance plan and associated governance cycle.
• Manage compliance efforts across the organization to support adherence to applicable laws, regulations, and standards, including GDPR, 21 CFR Part 11, HITRUST, ISO 27001, HIPAA, NIST 800-53, and applicable AI frameworks.

• Develop, implement, and maintain the organization’s Governance, Risk, and Compliance policies, procedures, and frameworks.
• Develop and implement compliance, risk, and privacy frameworks that support resilient business services, architectures, and processes.
• Ensure governance and compliance programs align with business objectives, regulatory requirements, and organizational risk tolerances.
• Translate regulatory requirements into actionable business unit initiatives and priorities.
• Serve as a trusted advisor to business unit leadership on compliance, privacy, governance, and risk matters.

• Lead the company-wide Enterprise Risk Management program.
• Collaborate with Product, Engineering, Business Operations, Sales, Support, Legal, Human Resources, and other operational teams to identify, evaluate, and mitigate risk.
• Maintain ongoing risk assessment and monitoring processes.
• Develop and implement effective risk mitigation strategies.
• Proactively identify emerging compliance and regulatory risks and recommend corrective actions.

• Oversee internal and external audit assessments.
• Evaluate compliance with internal policies, regulatory requirements, contractual obligations, and applicable industry standards.
• Coordinate audit readiness activities and support remediation of identified findings.
• Assist with preparation of Regulatory Affairs briefings for the Executive Committee, Board of Directors, and Compliance Committees.

• Lead Third-Party Supplier Management risk assessments and associated governance programs.
• Ensure third-party risk management activities align with business objectives and organizational risk tolerances.
• Manage supply chain risk processes, including vendor assessments, due diligence, and ongoing monitoring.
• Evaluate supplier compliance, security, privacy, and regulatory risk.

• Respond to customer compliance questionnaires in a timely and thorough manner.
• Develop customer-facing materials explaining organizational compliance policies, practices, and positions.
• Collaborate with cross-functional stakeholders to integrate compliance and risk management into organizational programs.
• Present complex regulatory, compliance, and risk topics to executive leadership, business stakeholders, customers, and other audiences.

• Partner with the Director of Information Security to align compliance initiatives with security strategy.
• Maintain awareness of information security practices and their relationship to compliance and privacy requirements.
• Ensure compliance with company policies related to security, confidentiality, privacy, and data protection.
• Support a secure and compliant operating environment across the organization.

• 8–10 years of experience in regulatory compliance, preferably within the healthcare or technology industry. [Required]
• Proven experience developing, implementing, and overseeing governance and compliance frameworks in complex, multi-regulatory environments. [Required]
• Experience assessing compliance risk and developing and implementing effective mitigation strategies. [Required]
• Experience overseeing or supporting internal and external audits, regulatory assessments, and compliance reviews.
• Experience with enterprise risk management, third-party risk management, and supplier due diligence.

• Deep knowledge of regulatory frameworks, standards, and industry best practices, including HITRUST, ISO 27001, SOC 2, 21 CFR Part 11, and NIST 800-53. [Required]
• Strong understanding of IT security standards, privacy laws, and compliance regulations. [Required]
• Familiarity with information security practices and their intersection with compliance requirements. [Required]
• Strong analytical skills and attention to detail. [Required]
• Ability to identify inconsistencies, compliance gaps, and emerging regulatory risks. [Required]
• Proactive problem-solving and risk mitigation capabilities. [Required]
• Proficiency with compliance management software and tools. [Required]
• Excellent project management skills. [Required]
• Excellent written and verbal communication skills. [Required]
• Ability to present complex regulatory frameworks and compliance requirements to technical, business, customer, and executive audiences. [Required]

• Advanced education or professional certification demonstrating deeper expertise in compliance, regulatory affairs, governance, risk, privacy, or a related discipline. [Required]

• Experience within healthcare, biomedical, life sciences, or technology-related industries.
• Experience operating within highly regulated, multi-framework environments.
• Experience integrating governance, compliance, privacy, and information security programs across complex organizations.