Sr. Manager, Compliance, Governance & Assurance

Senior Manager, Compliance, Governance & Assurance

The Information Security team is seeking an experienced Senior Manager, Compliance, Governance & Assurance reporting to the Senior Director, Governance, Risk & Compliance (GRC). In this role you will be responsible for maintaining and expanding the company's certification portfolio, ensuring compliance with regulatory, contractual, and customer requirements, establishing a mature policy governance framework, and building an internal assurance function that provides proactive oversight of control design, effectiveness and compliance obligations.

Our leadership model is about developing great leaders at all levels and creating opportunities for our people to grow personally, professionally, and financially. We are looking for leaders that are energized by creative and critical thinking, building strong partnerships across the organization, getting results the right way, and fostering a culture of accountability and continuous improvement.

Responsibilities

In this role, you will:

Compliance & Governance Leadership

• Lead and mature the enterprise compliance program, ensuring ongoing alignment with regulatory, contractual, customer, and industry requirements.
• Own the organization's compliance and certification portfolio, including SOC 2, ISO 27001, HIPAA, HITRUST, and other applicable frameworks, driving audit readiness and successful certification outcomes.
• Develop and maintain compliance and governance roadmap aligned with organizational priorities, risk management objectives, and business growth.
• Establish and oversee governance processes, metrics, and reporting that provide leadership visibility into compliance posture, risks, and program effectiveness.
• Monitor evolving regulatory and industry requirements and translate them into actionable governance, policy, and control improvements.

Policy Governance & Assurance

• Establish and mature the enterprise policy governance lifecycle, including policy development, review, approval, communication, exception management, and periodic maintenance.
• Build and operationalize a risk-based internal assurance function to evaluate compliance with policies, standards, regulatory obligations, and control requirements.
• Define and execute assurance methodologies, testing programs, and monitoring activities to assess control effectiveness and identify opportunities for continuous improvement.
• Develop a small, stable set of compliance and assurance health indicators that can be reported regularly to leadership.
• Define reusable compliance and governance capabilities, including policy management processes, assurance testing frameworks, control assessment methodologies, and audit readiness programs.

Audit, Certification & Stakeholder Management

• Partner with Internal Audit, Security, Privacy, Legal, Risk Management, and business leaders to coordinate audits, assessments, certifications, and customer due diligence activities.
• Lead remediation governance, ensuring findings, recommendations, and observations are appropriately prioritized, tracked, and resolved in a timely manner.
• Serve as a trusted advisor to leadership on compliance, governance, and assurance matters.
• Build strong relationships with external auditors, assessors, regulators, customers, and other key stakeholders.
• Leverage automation and Artificial Intelligence capabilities to improve compliance monitoring, evidence management, assurance activities, and operational efficiency.

People & Culture

• Manage a team with focus on policy and strategy implementation.
• Foster a culture of continuous learning, psychological safety, and security advocacy across the broader organization.

Qualifications

Your Knowledge and Experience

Required Qualifications

• A minimum of 8 years of progressive experience in compliance, governance, risk management, audit, assurance, or related disciplines.
• Bachelor's degree or higher in Business, Information Systems, Cybersecurity, Risk Management, Accounting, Finance, Public Policy, or a related field.
• A minimum of 4 years of people leadership experience with direct responsibility for supervising, coaching, and developing team members.
• Proven experience managing compliance programs and certification frameworks including SOC 2, ISO 27001, HIPAA, HITRUST, and similar industry standards.
• Demonstrated experience leading audits, assessments, remediation programs, and control maturity initiatives.
• Experience building or significantly maturing compliance, governance, assurance, or policy management programs.
• Strong understanding of governance, risk, compliance, internal control, and audit frameworks.
• Exceptional communication and stakeholder management skills, including experience influencing senior leadership and partnering effectively across Security, Privacy, Legal, Risk Management, Internal Audit, and business functions.
• Demonstrated ability to influence cross-functional teams and drive organizational change in complex environments.

Preferred Qualifications

• Master's degree in Business Administration, Information Systems, Cybersecurity, Risk Management, or a related discipline.
• Professional certifications such as CISA, CRISC, CISSP, CIPP, CHC, CCEP, HITRUST CCSFP, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent.
• Experience operating within highly regulated industries, including healthcare, financial services, or technology organizations.
• Experience implementing governance, risk, and compliance (GRC) platforms and compliance automation capabilities.
• Experience supporting privacy programs and privacy-related compliance requirements, including HIPAA, GDPR, and state privacy regulations.

Leadership Competencies

• Ability to define and execute a strategic vision for compliance, governance, and assurance maturity.
• Skilled at leading through influence across security, legal, privacy, audit, technology, and business teams.
• Applies metrics, risk-based decision-making, and evidence-based reasoning to prioritize investments and remediation activities.
• Thrives in fast-paced and evolving environments while maintaining operational rigor and accountability.
• Passionate about building scalable programs, improving organizational effectiveness, and developing future leaders.
• Acumen & Communication: Translates complex compliance and governance concepts into clear business language and builds trust with technical and non-technical stakeholders alike.

Hybrid

This role requires employees to be in-office based on our hybrid workplace model, balancing purposeful in-person collaboration with flexibility. For most teams, this means coming into the office two days each week.

Employees living more than 50 miles from an office location will work with their manager to determine in-office time based on business need.

About Us

About Stellarus and the Ascendiun Family of Companies

Stellarus, launched in January 2025, is designed to scale innovative healthcare solutions that support customers in creating a health care experience deserving of their family, friends, and neighbors. Stellarus is part of a family of organizations that is overseen by a nonprofit corporate entity named Ascendiun. The Ascendiun Family of Companies also includes Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan and Altais, a clinical services company.

Stellarus' vision is to empower its customers to create a healthcare experience that is worthy of their family, friends, and neighbors. Stellarus' objective is to offer innovative, modern, scalable solutions that challenge the health care status quo. This very closely aligns with Blue Shield of California's vision by using innovation to improve quality, affordability, and experience for members.

To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals.

Our Values:

At Stellarus, our core values of agility, trust, drive, courage and service shape our approach to developing innovative product offerings.

Our Workplace Model:

We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility:

• For most teams, this means coming into the office two days per week.
• Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need.
• For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being.

The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews.

Physical Requirements:

Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level