Information Security Governance, Risk, Compliance (GRC) Supervisor

About the role

The Information Security Governance, Risk, and Compliance (GRC) Supervisor at ARUP provides leadership and direction for the Information Security GRC program, ensuring alignment with ARUP security policies, healthcare regulatory requirements, and the NIST Risk Management Framework. This role serves as a critical bridge between information security, technology teams, and business owners—translating regulatory and technical security requirements into practical, actionable guidance.

Responsibilities

• Serves as a primary educator and change agent for the organization, responsible for teaching, training, and transitioning ARUP Business Owners, System Owners, and technical teams to operate in compliance with NIST security frameworks and ARUP security policies.
• Designs and delivers structured training, workshops, and guidance to help business and system owners understand their security responsibilities, risk ownership, control implementation requirements, and ongoing compliance obligations under NIST SP 800-53.
• Conducts and oversees - system-level risk assessments, translating technical and regulatory requirements into clear, actionable guidance for business stakeholders.
• Leads the development, review, and maintenance of security policies, standards, and procedures, ensuring alignment with ARUP policy, HIPAA, CAP, SOC 2, GDPR, ISO standards, and NIST RMF requirements.
• Leads internal audits, compliance reviews, and external audit preparation, including coordination with auditors and facilitation of evidence collection, remediation planning, and executive reporting.
• Delivers compliance and governance services to business and system owners, supporting full lifecycle alignment with NIST SP 800-53 controls, enterprise risk governance frameworks, and ARUP security policy requirements.
• Collaborates with cross-functional teams (IT, Infrastructure, Applications, and Operations) to integrate risk management and compliance practices into organizational processes, including Configuration Management, Change Management, and Change Approval Board (CAB).
• Maintains System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and other required cybersecurity documentation.
• Identifies gaps in security controls, recommends risk-based improvements, and oversees the implementation and tracking of corrective actions to closure.
• Supports system authorization and accreditation activities, ensuring operational environments meet defined security requirements and governance expectations.
• Develops and maintains compliance dashboards, risk metrics, and executive-level reporting to communicate risk posture, compliance status, and trends to leadership concerning information security.
• Builds and sustains strong working relationships with System Owners, Authorizing Officials, System Administrators, and business leaders to promote shared accountability for information security risk management.
• Leads and mentors a team of information security GRC analysts and cybersecurity professionals, providing clear direction, coaching, and performance oversight.
• Works under moderate supervision, exercising independent judgment in governance, risk, and compliance decision-making, and may mentor junior team members.
• Supports 24-hour operational requirements as needed, including time-sensitive risk assessments, audits, or incident-related governance activities.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Information Technology, or a related field.
• Minimum of 5 years of experience in information security, risk management, or a related field.
• Experience with NIST RMF, HIPAA, CAP, SOC 2, GDPR, ISO standards, and other relevant regulatory frameworks.
• Strong understanding of cybersecurity principles, risk assessment methodologies, and compliance requirements.
• Excellent communication and interpersonal skills, with the ability to effectively collaborate with various stakeholders.
• Ability to lead and mentor a team of professionals.
• Proficiency in Microsoft Office Suite and familiarity with cybersecurity tools and technologies.