← All roles

Governance Risk Compliance

Hippocratic AI· G&A
Apply on company site
Menlo Park, CAFull-timePosted 4d ago

About the role

GRC Program Lead to own and scale Hippocratic AI's governance, risk, and compliance program, reporting to the CISO. Serves as central point of contact for certifications, attestations, privacy, regulatory and AI governance initiatives, and enterprise risk management across multiple teams and international markets.

Responsibilities

  • Certifications, Frameworks & Compliance Programs: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de-identification standards and applicable CMS regulations and federal guidelines.
  • ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027.
  • International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, in-country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act).
  • Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC).
  • Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence.
  • Policy management: Draft, update, and communicate internal and external compliance policies.
  • Risk, Privacy & Governance: Enterprise risk management, vendor risk assessments, data privacy PIAs and DPIAs, data maps and privacy notices for US and international jurisdictions, AI governance alignment with emerging laws and regulations.
  • Audit, Assurance & Program Operations: Lead external audits and customer security assessments, manage security questionnaires and RFP responses, oversee annual assessments and renewals, deliver presentations, maintain trust center dashboards and evidence, build metrics and reporting framework, deliver training on privacy and security.

Qualifications

  • AI skillset and examples of use
  • Bachelor's degree; CISM, CRISC, CHPC, or similar certifications preferred.
  • 5+ years in GRC, compliance, or audit, ideally in a healthcare or payor environment.
  • Strong working knowledge of HIPAA, HITRUST, SOC 2, and ISO 42001; international data protection laws (GDPR, UK GDPR) and operational controls.
  • Hands-on experience with customer security assessments, TPRM portals, and GRC or trust-center tooling (e.g., Vanta).
  • Proven experience leading risk assessments, audits, vendor risk reviews, and compliance reviews; strong analytical and communication skills.
  • Confident presenter; able to explain complex topics to customers, executives, and non-technical audiences.
  • Startup experience; comfortable operating with ambiguity and minimal supervision.
  • Detail-oriented, organized, adaptable, with integrity and discretion; collaborative across clinical, administrative, and technical teams.

Skills

Required:GRC program leadershipRegulatory compliance (HIPAA, HITRUST, SOC 2, ISO 42001)Data privacy & DPIA managementVendor risk managementAudits & customer security assessments

Benefits

  • Not specified in the description.
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Hippocratic AI

Safest Healthcare Generative AI Agents

Safest Healthcare Generative AI Agents Our AI agents do not diagnose or prescribe. Learn more. Listen to these 4 real de-identified calls from the over 115 million clinical interactions.

HealthcareAIGenerative AIClinical InteractionsPatient Care
Company profileWebsite

More open roles at Hippocratic AI