IT Security Supervisor, GRC

Description

The Head of Governance Risk and Compliance (GRC) supports the Manager of Cyber Risk Management with theirexpert knowledge of cybersecurity risk management contractual and regulatory compliance and security control frameworks to analyze and manage risk institution-wide security issues across UCSF Health Campus Foundation and affiliated environments. Serves as functional leader for GRC team and directs day-to-day execution of enterprise cyber risk and compliance services. Provides sustained staff direction work prioritization mentoring training escalation handling and quality oversight across complex risk assessments including AI solutions; security exceptions; policy interpretation; contract reviews third-party reviews; and enterprise compliance activities including PCI-DSS HIPAA UC policy and NIST-based frameworks. Leads projects and program improvements with organization-wide impact including ServiceNow IRM and IT Service Management workflows metrics training quality controls and operating standards. Employ AI solutions to increase service capacity and accelerate delivery. Regularly interfaces with senior stakeholders auditors and business owners and provides expert guidance and operational direction to team members. Works with the UC Office of the President and other UC campuses on system-wide initiatives. The proposed IT Security Supervisor 2 classification reflects the closest available title for a role that now carries sustained staff direction program accountability and enterprise operational leadership responsibilities.

Department Overview

UCSF Cybersecurity protects and responds to both internal and external threats. It monitors vulnerabilities risks and exposures and mitigates issues prior to exploitation. If an incident does occur IT Security investigates determines impact and recommends controls for reduced recurrence likelihood.

• Vulnerability Management
• Network Security
• Data security and protection
• Security architecture and design review
• Incident response and forensic analysis
• Cyber threat intelligence
• Threat hunting and event analysis
• Establishing policies and standards for information security
• Conducting security risk assessments of systems solutions and vendors
• Governance risk and compliance
• Architecting secure business solutions
• Outreach and security awareness training and education
• Endpoint security including encryption anti-malware endpoint detection and response
• Application security
• E-Discovery and forensic services

REQUIRED QUALIFICATIONS

• Bachelors degree in related area and or equivalent experience and training.
• Minimum of five (5) years of progressively responsible experience in cybersecurity information security governance risk and compliance (GRC) or related field
• Advanced knowledge of cybersecurity privacy and compliance laws regulations standards and policy frameworks relevant to higher education and healthcare including UC and UCSF policy PCI DSS HIPAA Security Rule NIST frameworks and audit expectations.
• Experience directing and coordinating the work of technical or risk/compliance staff including assigning and prioritizing work setting expectations coaching mentoring training and reviewing work quality.
• Experience providing day-to-day functional leadership for a security risk or compliance program including coordination of operational activities issue escalation quality oversight and continuous improvement.
• Advanced experience leading security risk assessments compliance reviews remediation planning and risk-based decision-making across healthcare research education implementation and vendor environments.
• Demonstrated ability to determine recommend and communicate courses of action to departments and leadership on IT security compliance and risk matters in complex operational environments.
• Experience developing implementing and improving security workflows standards procedures metrics reporting quality controls and program documentation.
• Advanced experience with GRC or IRM platforms risk assessment processes security exceptions risk acceptance audit response and related compliance activities.
• Advanced ability to analyze complex technical operational and compliance issues and develop defensible risk-based recommendations using sound judgment.
• Broad knowledge of cybersecurity concepts and operating principles including networks applications cloud services encryption identity and access management logging endpoint security third-party services enterprise applications hardware software and vendor IT products.
• Strong written and verbal communication skills including the ability to prepare reports presentations guidance and other materials for varied audiences including senior leadership.
• Experience interfacing with auditors assessors executives project teams and cross-functional stakeholders on significant security compliance or risk matters.

• Advanced interpersonal consultative and influence skills sufficient to work effectively with technical and non-technical personnel at all levels of the organization and build productive working relationships.

PREFERRED QUALIFICATIONS

• Advanced coursework or training in cybersecurity risk management audit or compliance.
• Minimum of three (3) years of experience supervising leading or providing sustained direction to professional staff
• Knowledge of institutional processes governance structures and regulated data environments in higher education and/or healthcare.
• ServiceNow IRM GRC or ITSM experience.
• Certifications
  • PCI ISA
  • CISSP
  • CISA or CRISC
  • ServiceNow IRM GRC or comparable platform certification

Required Experience:

Manager