Director, Governance, Risk, and Compliance – GRC
Job Description:
- Define and evolve Clover Health’s security governance and risk management strategy, aligning function-level priorities with enterprise objectives and the security roadmap.
- Establish a risk-driven approach to governance aligned with HIPAA Security and Privacy Rules, NIST Cybersecurity Framework (CSF) v2, and NIST AI Risk Management Framework (AI RMF), where applicable.
- Anticipate security and regulatory risks 12+ months out, using business, product, regulatory, and market signals to inform strategy and tradeoffs.
- Ensure security risk decisions are clearly framed, documented, and communicated in business terms for executive and board-level audiences.
- Assist the CISO in setting security risk priorities, framing tradeoffs, and communicating risk posture and progress to executive leadership and the Board.
- Own Clover Health’s security compliance posture as a public healthcare company, including federal and state regulatory obligations.
- Lead security-related audits, assessments, and regulatory inquiries in partnership with Legal, Compliance, Privacy, and Internal Audit.
- Drive clarity, consistency, and maturity in security policies, standards, and procedures.
- Ensure compliance efforts are proactive, scalable, integrated into how Clover Health builds and operates products, and maintained over time to support ongoing audit readiness and regulatory expectations.
- Own high-stakes outcomes for the GRC function, ensuring accountability across internal partners and third-party providers.
- Lead Clover Health’s third-party security risk management program end-to-end.
Requirements:
- 8+ years of experience in information security, GRC, risk management, or related disciplines.
- Demonstrated experience leading security governance and compliance programs in regulated environments.
- Strong working knowledge of HIPAA and healthcare security requirements.
- Experience operating in a public company or similarly regulated environment.
- Proven experience managing third-party vendors providing GRC services or staff augmentation.
- Hands-on experience with incident response governance, crisis management, disaster recovery, and business continuity.
- Strong business acumen with the ability to translate security and compliance risks into business impact.
- Excellent executive-level communication and stakeholder management skills.
Benefits:
- Financial Well-Being: Our commitment to attracting and retaining top talent begins with a competitive base salary and equity opportunities. Additionally, we offer a performance-based bonus program, 401k matching, and regular compensation reviews to recognize and reward exceptional contributions.
- Physical Well-Being: We prioritize the health and well-being of our employees and their families by providing comprehensive medical, dental, and vision coverage. Your health matters to us, and we invest in ensuring you have access to quality healthcare.
- Mental Well-Being: We understand the importance of mental health in fostering productivity and maintaining work-life balance. To support this, we offer initiatives such as No-Meeting Fridays, monthly company holidays, access to mental health resources, and a generous flexible time-off policy. Additionally, we embrace a remote-first culture that supports collaboration and flexibility, allowing our team members to thrive from any location.
- Professional Development: Developing internal talent is a priority for Clover. We offer learning programs, mentorship, professional development funding, and regular performance feedback and reviews.
- Additional Perks: Employee Stock Purchase Plan (ESPP) offering discounted equity opportunities, reimbursement for office setup expenses, monthly cell phone & internet stipend, remote-first culture, enabling collaboration with global teams, paid parental leave for all new parents, and much more!