Global Risk Compliance

About the Role

Hippocratic AI is looking for a GRC Program Lead to own and scale our governance, risk, and compliance program. Reporting to the CISO, you will be the central point of contact for certifications and attestations (SOC 2, HITRUST, HIPAA, ISO 42001), customer security assurance, U.S. and international data privacy, regulatory and AI governance initiatives, and enterprise risk management. You will work across Sales, Engineering, DevOps, Clinical, and Legal teams to keep our compliance posture ahead of the demands of health systems, payors, pharma and life-science partners, federal customers, and new international markets.

Responsibilities

Certifications, Frameworks & Compliance Programs

- Framework and certification oversight: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de-identification standards and applicable CMS regulations and federal guidelines.

- ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027.

- International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, in-country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act) as we enter new markets.

- Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC) as they apply to our business.

- Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence.

- Policy management: Draft, update, and communicate internal and external compliance policies.

Risk, Privacy & Governance

- Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the...