Manager, Security Governance, Risk & Compliance

The Manager, Security Governance, Risk & Compliance is a hands-on program leadership role supporting the security governance, risk, and compliance program for Cedar Gate Technologies, a healthcare technology business recently acquired by IQVIA. The role reports to the Associate Director responsible for Cedar Gate security and works in close partnership with that leader to run and mature a program that directly supports client trust, audit commitments, and revenue.

Cedar Gate maintains SOC 1, SOC 2, and HITRUST r2 certifications and supports a steady flow of client security reviews, questionnaires, and audit requests. This role oversees the execution of recurring compliance controls — performed largely by an operations team in Nepal — and leads the programs built around them: audit administration, customer assurance, enterprise risk, business continuity, policy, and third-party risk.

A core near-term priority is rebuilding and maturing the enterprise risk program, including interview-driven risk assessments, business impact analyses, disaster recovery planning, and risk exception management with business owners, application leaders, and remediation teams. As integration with IQVIA progresses, the role will help align Cedar Gate’s program with IQVIA’s security and compliance frameworks and expand to support the broader Information Security organization. You will sit within the global Information Security organization, working closely with Cedar Gate IT, product, business operations, and leadership teams, the Nepal operations team, external auditors, and clients.

Principal responsibilities will include:

• Partner with the Associate Director to run Cedar Gate’s security governance, risk, and compliance program, driving planning, execution, and reporting across compliance, audit, risk, and customer assurance workstreams.

• Administer annual SOC 1 and SOC 2 audits and HITRUST r2 and interim assessments, coordinating evidence requests, interviews, and walkthroughs between auditors and internal control owners, and driving gap resolution and escalations.

• Manage audit vendor relationships in partnership with the Associate Director, including vendor selection, contracts, deliverables, and payment.

• Oversee the execution and quality of recurring compliance controls performed by the Nepal operations team, including logical and physical access reviews, termination reviews, elevated access reviews, backup validation, patching compliance audits, and the annual facility security audit — reviewing results, identifying gaps, and escalating issues to resolution.

• Oversee data protection controls, including monthly data destruction sample audits, review and issuance of data destruction certificates for clients, and DLP reviews of PHI activity across AWS WorkSpaces users.

• Support client security reviews, questionnaires, and audit-related communications, including executing SOC 2 NDAs and distributing SOC reports to clients and prospects.

• Mature the enterprise risk program, maintaining the risk register, leading interview-based risk assessments, managing risk exceptions, and tracking treatment and remediation plans with accountable owners.

• Deliver regular risk reporting to Cedar Gate and IQVIA leadership on risk register changes, results, and trends, alongside metrics on control effectiveness and audit status.

• Lead the annual business impact analysis and maintain business continuity and disaster recovery plans, assessing new products and updating plans for existing ones.

• Develop, review, and update security policies and procedures in partnership with the Associate Director, coordinating stakeholder input and approvals.

• Oversee third-party risk management for Tier 1 Cedar Gate vendors, including annual reviews of vendor security posture.

• Coordinate same-day response to significant audit findings, emerging security risks, compliance issues, and customer-driven requests across multiple stakeholders.

• Support integration by aligning Cedar Gate controls, policies, and evidence processes with IQVIA frameworks, and contribute to broader IQVIA governance, risk, and compliance initiatives as integration progresses.

Required Experience and Qualifications

• 5–8 years of experience in security governance, risk and compliance, IT audit, or security compliance roles.

• Hands-on experience administering SOC 1 and SOC 2 audits, including evidence management, auditor coordination, and control owner walkthroughs.

• Hands-on experience with HITRUST CSF assessments, ideally including r2 and interim assessments.

• Experience operating or testing IT general controls, including access reviews, termination and elevated access processes, patch management, backup, and data destruction.

• Experience building or maturing an enterprise or IT risk management program, including risk registers, interview-based risk assessments, exception processes, and remediation tracking.

• Experience with business impact analysis, business continuity, and disaster recovery planning.

• Experience supporting customer assurance activities such as security questionnaires, client audits, and SOC report distribution.

• Experience with third-party risk management and vendor security assessments.

• Working knowledge of HIPAA/HITECH requirements and PHI handling controls.

• Experience overseeing work performed by offshore or distributed teams without direct reporting lines, including quality review, follow-up, and escalation.

• Familiarity with cloud environments, preferably AWS, and common security controls such as DLP and endpoint protection.

• Strong organizational and program management skills, with the ability to run a recurring control calendar and multiple concurrent audits against firm deadlines.

• Ability to work credibly with executives, auditors, clients, and control owners, and to drive decisions on sensitive findings and risk treatment.

• Experience in healthcare, health technology, or other regulated environments is preferred.

• Bachelor’s degree in Information Security, Information Systems, Business, or equivalent practical experience is preferred.

• Relevant certifications such as CISA, CISSP, CRISC, or HITRUST CCSFP are preferred.

IQVIA is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com

IQVIA is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other status protected by applicable law. https://jobs.iqvia.com/eoe

IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.

The potential base pay range for this role, when annualized, is $90,200.00 - $225,600.00. The actual base pay offered may vary based on a number of factors including job-related qualifications such as knowledge, skills, education, and experience; location; and/or schedule (full or part-time). Dependent on the position offered, incentive plans, bonuses, and/or other forms of compensation may be offered, in addition to a range of health and welfare and/or other benefits.