Vendor Risk Management Jobs in Delaware (NOW HIRING)

Job Summary:
The University of Delaware is seeking a Director of GRC and Security Architecture to lead the organization's information security risk, compliance, and architectural security posture. This senior leadership role involves overseeing the enterprise-wide governance, risk management, and security architecture, ensuring compliance with regulations such as HIPAA while partnering with various teams to implement effective security controls.
Responsibilities:
• Lead the enterprise Information Security Governance, Risk, and Compliance (GRC) program.
• Establish and maintain security policies, standards, procedures, and control frameworks aligned with NIST, HITRUST, ISO 27001, and other applicable frameworks.
• Oversee enterprise risk assessments, third-party risk management, and control effectiveness evaluations.
• Translate regulatory, legal, and contractual requirements into actionable security controls and architectural standards.
• Ensure ongoing compliance with applicable regulations and standards, including HIPAA, PCI DSS, FERPA, SOC 2, and FIPS-140, as applicable
• Serve as the organization’s designated HIPAA Security Officer.
• Oversee administrative, technical, and physical safeguards required under the HIPAA Security Rule.
• Partner with Privacy, Legal, Compliance, and Health IT leadership on risk analyses, remediation plans, and regulatory inquiries.
• Support audits, investigations, and compliance reviews related to protected health information (PHI).
• Ensure appropriate security awareness and HIPAA training programs are developed and delivered across the organization.
• Own and lead the security architecture function, defining enterprise security architecture principles, reference architectures, and design standards.
• Review and approve security architecture for new systems, applications, cloud services, and major technology initiatives.
• Ensure security is embedded early in system lifecycle activities through secure-by-design and defense-in-depth principles.
• Partner with infrastructure, cloud, application, and DevOps teams to integrate security requirements into platforms and solutions.
• Guide architectural decisions related to identity, network segmentation, encryption, key management, logging, and data protection.
• Contribute to and lead multi-year security strategy and roadmap development in alignment with organizational objectives.
• Actively participate in enterprise security and risk governance forums, advising executive leadership on risk posture and architectural trade-offs.
• Balance risk reduction with operational efficiency, usability, and institutional mission requirements.
• Serve as a trusted advisor to schools, departments, and business units on risk and architectural security decisions.
• Provide governance and oversight for security technologies supporting risk management, compliance, and architectural controls.
• Ensure alignment between security architecture standards and operational security tooling.
• Evaluate new security technologies and frameworks to address evolving regulatory and threat landscapes.
• Develop and report meaningful risk and compliance metrics to senior leadership and governance committees.
• Communicate complex security and compliance topics clearly to technical and non-technical stakeholders.
• Provide executive-level reporting on risk trends, compliance posture, and architectural maturity.
• Lead and develop GRC and security architecture professionals.
• Establish clear role definitions, performance expectations, and professional development pathways.
• Foster a culture of accountability, continuous improvement, and collaboration across security and IT teams.
• Manage budgets associated with GRC, compliance, and security architecture programs.
• Oversee vendor relationships related to risk management, compliance tooling, and architectural services.
• Ensure responsible financial stewardship and alignment with strategic priorities.
Qualifications:
Required:
• Bachelor’s degree in Information Security, Computer Science, Information Systems, or a related field
• Seven years of progressive experience in information security, risk management, or IT, including leadership roles
• Demonstrated experience leading GRC programs, regulatory compliance efforts, and enterprise risk management
• Strong knowledge of HIPAA Security Rule, PCI DSS, and related regulatory frameworks
• Proven experience defining and governing security architecture across enterprise and cloud environments
• Excellent written and verbal communication skills, including executive-level presentations
Preferred:
• Master’s degree in Information Security, Computer Science, Information Systems, or a related field
• Experience supporting healthcare, higher education, or regulated enterprise environments
• Hands-on experience with NIST, HITRUST CSF, ISO 27001, SOC 2, and third-party risk frameworks
• Professional certifications such as CISSP, CISM, CRISC, or equivalent
• Experience partnering closely with SOC, IR, Privacy, and Legal teams
• Demonstrated success leading organizational change and maturing security governance programs
Company:
The University of Delaware - a state assisted, privately chartered institution - is a Land Grant, Sea Grant, Space Grant and Carnegie Research University (very high research activity). Founded in 1743, the company is headquartered in Newark, DE, US, , with a team of 1001-5000 employees. The company is currently Late Stage.