Insulet Corporation
Head of Technology Governance Risk Compliance (GRC) - (Hybrid - San Diego, CA or
Insulet Corporation, Acton, Massachusetts, us, 01720
Head of Technology Governance Risk Compliance (GRC) — Hybrid (San Diego, CA or Acton, MA)
The Head of Technology (GRC) reports directly to the Chief Information Security Officer and leads an enterprise-wide function encompassing Information Security, Governance, Technology Risk, and Compliance (GRC). This role builds the organization’s technology risk, compliance, and resiliency strategy, proactively identifying and mitigating risks, and ensuring alignment with external auditors, regulators, and legal teams. The leader chairs the cross‑functional Technology Risk Committee and presents, alongside the CISO, to the Executive Leadership Team (ELT) and Board of Directors on compliance/regulatory status, governance, and technology risk posture.
Responsibilities Governance & Policy Leadership
Set the strategic direction of the Technology GRC organization and oversee the team that designs, implements, and maintains the IT GRC framework, including policies, standards, and controls aligned with business objectives and risk appetite.
Oversee and set the roadmap for the Information Security Management System (ISMS), ensuring alignment with ISO 27001 and other relevant frameworks.
Oversee self‑assessments, escalating decisions and decisions per requirements to drive risk reduction.
Govern the Business Continuity Management Program and lead risk quantification efforts.
Risk Management
Design and implement a robust Three‑Lines‑of‑Defense (3LOD) framework, delineating roles and responsibilities across business units, risk management, and internal audit.
Lead risk assessment activities, integrating findings into the Risk Register or the Enterprise Risk Management (ERM) program.
Maintain and report on the risk register, risk treatment plans, and mitigation strategies.
Provide actionable, data‑driven insights to executive leadership and the Board on risk posture and emerging threats.
Regulatory Compliance & Audit
Ensure compliance with HIPAA, HITECH, FDA cybersecurity guidance, SOX, GDPR, CMMC, and other applicable regulations.
Oversee internal and external audits, including SOC 2, ISO 27001, and HITRUST certifications.
Serve as the primary liaison to auditors, regulators, and legal teams on cybersecurity compliance matters.
Third‑Party & Supply Chain Risk
Lead the third‑party risk management program, including vendor due diligence, contract reviews, and continuous monitoring.
Ensure supply‑chain security practices meet regulatory and industry expectations, including FDA and SEC guidance.
Security Awareness & Culture
Oversee enterprise‑wide security awareness and training programs, including phishing simulations and compliance education.
Foster a culture of risk awareness and accountability across all levels of the organization.
Incident Response & Resilience
Govern the enterprise cyber incident response plan, including tabletop exercises and business continuity planning.
Ensure readiness for ransomware, data breaches, and other high‑impact events.
Lead the development of an enterprise‑wide Business Continuity Program (BCP), ensuring readiness for operational disruptions.
Metrics & Reporting
Define and track key performance indicators (KPIs/KRIs) and metrics for risk, quantification, compliance, and control effectiveness.
Deliver quarterly board updates, annual program reviews, and ad‑hoc reports on incidents, audits, and compliance status.
Strategic & External Engagement
Represent the organization in industry forums (e.g., H‑ISAC), regulatory discussions, and peer collaborations.
Stay ahead of emerging technologies (e.g., AI, IoMT, cloud) and evolving regulatory landscapes to inform GRC strategy.
Develop budgets and resource requirements for direct reporting teams.
Participate in the development of team strategic plans, annual goal and delivery plans, and quarterly and monthly updates and retrospectives.
Required Leadership/Interpersonal Skills & Behaviors
Proven executive leader with a track record of building and scaling high‑performing, cross‑functional teams in complex, regulated environments.
Demonstrated ability to influence across the enterprise, including ELT and Board‑level stakeholders, to drive alignment and accountability for risk and compliance outcomes.
Builds trust quickly and leads with integrity, transparency, and a collaborative mindset.
Skilled at navigating ambiguity and driving clarity in high‑stakes, fast‑paced environments.
Required Skills And Competencies
Deep expertise in security and risk frameworks and regulations, including NIST CSF, ISO 27001, SOC 2, HIPAA, HITRUST, FDA cybersecurity guidance, GDPR, and SOX.
Strong executive presence with the ability to translate complex risk and compliance issues into actionable business insights for C‑level and Board audiences.
Experience leading enterprise‑wide GRC programs that span cybersecurity, privacy, product security, and data governance.
Demonstrated success in maturing GRC capabilities through automation, metrics, and continuous improvement.
Managed and mentored teams of 15+ and held the title of a director or above.
Preferred
Advanced degree (e.g., MBA, MS in Cybersecurity, or related discipline).
Professional certifications such as CISSP, CISM, CISA, CRISC, or CIPP.
Experience with GRC platforms and automation tools (e.g., Archer, ServiceNow GRC, OneTrust).
Familiarity with cloud security compliance frameworks (e.g., CSA CCM, FedRAMP, HITRUST for cloud).
Experience integrating cybersecurity with enterprise risk management, privacy, and product lifecycle governance.
Demonstrated ability to apply a methodical, risk‑based approach to evaluating and governing the use of AI technologies across the enterprise.
Education And Experience
15–20+ years of progressive experience in information security, risk management, or IT audit, with at least 5 years in a senior GRC leadership role.
Proven experience leading global GRC teams and managing complex compliance programs in highly regulated industries (e.g., healthcare, medtech, financial services).
Additional Information
The position is hybrid at our Acton/SD/Bay Area office.
Travel is estimated at 25% but will flex depending on business needs.
Salary The US base salary range for this full‑time position is $217,275.00 - $325,912.50.
At Insulet Corporation all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
#J-18808-Ljbffr
Responsibilities Governance & Policy Leadership
Set the strategic direction of the Technology GRC organization and oversee the team that designs, implements, and maintains the IT GRC framework, including policies, standards, and controls aligned with business objectives and risk appetite.
Oversee and set the roadmap for the Information Security Management System (ISMS), ensuring alignment with ISO 27001 and other relevant frameworks.
Oversee self‑assessments, escalating decisions and decisions per requirements to drive risk reduction.
Govern the Business Continuity Management Program and lead risk quantification efforts.
Risk Management
Design and implement a robust Three‑Lines‑of‑Defense (3LOD) framework, delineating roles and responsibilities across business units, risk management, and internal audit.
Lead risk assessment activities, integrating findings into the Risk Register or the Enterprise Risk Management (ERM) program.
Maintain and report on the risk register, risk treatment plans, and mitigation strategies.
Provide actionable, data‑driven insights to executive leadership and the Board on risk posture and emerging threats.
Regulatory Compliance & Audit
Ensure compliance with HIPAA, HITECH, FDA cybersecurity guidance, SOX, GDPR, CMMC, and other applicable regulations.
Oversee internal and external audits, including SOC 2, ISO 27001, and HITRUST certifications.
Serve as the primary liaison to auditors, regulators, and legal teams on cybersecurity compliance matters.
Third‑Party & Supply Chain Risk
Lead the third‑party risk management program, including vendor due diligence, contract reviews, and continuous monitoring.
Ensure supply‑chain security practices meet regulatory and industry expectations, including FDA and SEC guidance.
Security Awareness & Culture
Oversee enterprise‑wide security awareness and training programs, including phishing simulations and compliance education.
Foster a culture of risk awareness and accountability across all levels of the organization.
Incident Response & Resilience
Govern the enterprise cyber incident response plan, including tabletop exercises and business continuity planning.
Ensure readiness for ransomware, data breaches, and other high‑impact events.
Lead the development of an enterprise‑wide Business Continuity Program (BCP), ensuring readiness for operational disruptions.
Metrics & Reporting
Define and track key performance indicators (KPIs/KRIs) and metrics for risk, quantification, compliance, and control effectiveness.
Deliver quarterly board updates, annual program reviews, and ad‑hoc reports on incidents, audits, and compliance status.
Strategic & External Engagement
Represent the organization in industry forums (e.g., H‑ISAC), regulatory discussions, and peer collaborations.
Stay ahead of emerging technologies (e.g., AI, IoMT, cloud) and evolving regulatory landscapes to inform GRC strategy.
Develop budgets and resource requirements for direct reporting teams.
Participate in the development of team strategic plans, annual goal and delivery plans, and quarterly and monthly updates and retrospectives.
Required Leadership/Interpersonal Skills & Behaviors
Proven executive leader with a track record of building and scaling high‑performing, cross‑functional teams in complex, regulated environments.
Demonstrated ability to influence across the enterprise, including ELT and Board‑level stakeholders, to drive alignment and accountability for risk and compliance outcomes.
Builds trust quickly and leads with integrity, transparency, and a collaborative mindset.
Skilled at navigating ambiguity and driving clarity in high‑stakes, fast‑paced environments.
Required Skills And Competencies
Deep expertise in security and risk frameworks and regulations, including NIST CSF, ISO 27001, SOC 2, HIPAA, HITRUST, FDA cybersecurity guidance, GDPR, and SOX.
Strong executive presence with the ability to translate complex risk and compliance issues into actionable business insights for C‑level and Board audiences.
Experience leading enterprise‑wide GRC programs that span cybersecurity, privacy, product security, and data governance.
Demonstrated success in maturing GRC capabilities through automation, metrics, and continuous improvement.
Managed and mentored teams of 15+ and held the title of a director or above.
Preferred
Advanced degree (e.g., MBA, MS in Cybersecurity, or related discipline).
Professional certifications such as CISSP, CISM, CISA, CRISC, or CIPP.
Experience with GRC platforms and automation tools (e.g., Archer, ServiceNow GRC, OneTrust).
Familiarity with cloud security compliance frameworks (e.g., CSA CCM, FedRAMP, HITRUST for cloud).
Experience integrating cybersecurity with enterprise risk management, privacy, and product lifecycle governance.
Demonstrated ability to apply a methodical, risk‑based approach to evaluating and governing the use of AI technologies across the enterprise.
Education And Experience
15–20+ years of progressive experience in information security, risk management, or IT audit, with at least 5 years in a senior GRC leadership role.
Proven experience leading global GRC teams and managing complex compliance programs in highly regulated industries (e.g., healthcare, medtech, financial services).
Additional Information
The position is hybrid at our Acton/SD/Bay Area office.
Travel is estimated at 25% but will flex depending on business needs.
Salary The US base salary range for this full‑time position is $217,275.00 - $325,912.50.
At Insulet Corporation all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
#J-18808-Ljbffr