{"id":3220069,"url":"https://alion.io/job/lifelancer-manager-security-governance-risk-compliance","title":"Manager, Security Governance, Risk & Compliance","company":{"id":3853997,"name":"Lifelancer","domain":"lifelancer.com","url":"https://alion.io/company/lifelancer","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":true,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Management","role_family":"Management","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":90200,"max":225600,"currency":"USD","period":"year","gross":null,"usd_annual":225600},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"DLP","optional":false},{"name":"HIPAA","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-10-24T23:22:33Z","employer_posted_date":null,"last_verified_at":"2026-10-24T23:22:33Z","board_verified":false,"closed_at":null,"days_open":10,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":10},"description":"Job Title: Manager, Security Governance, Risk & Compliance\nJob Location: Durham, North Carolina, United States of America\nJob Location Type: Remote\nJob Contract Type: Full-time\nJob Seniority Level: The Manager, Security Governance, Risk & Compliance is a hands-on program leadership role supporting the security governance, risk, and compliance program for Cedar Gate Technologies, a healthcare technology business recently acquired by IQVIA. The role reports to the Associate Director responsible for Cedar Gate security and works in close partnership with that leader to run and mature a program that directly supports client trust, audit commitments, and revenue.\n\nCedar Gate maintains SOC 1, SOC 2, and HITRUST r2 certifications and supports a steady flow of client security reviews, questionnaires, and audit requests. This role oversees the execution of recurring compliance controls — performed largely by an operations team in Nepal — and leads the programs built around them: audit administration, customer assurance, enterprise risk, business continuity, policy, and third-party risk.\n\nA core near-term priority is rebuilding and maturing the enterprise risk program, including interview-driven risk assessments, business impact analyses, disaster recovery planning, and risk exception management with business owners, application leaders, and remediation teams. As integration with IQVIA progresses, the role will help align Cedar Gate’s program with IQVIA’s security and compliance frameworks and expand to support the broader Information Security organization. You will sit within the global Information Security organization, working closely with Cedar Gate IT, product, business operations, and leadership teams, the Nepal operations team, external auditors, and clients.\n\nPrincipal responsibilities will include:\nPartner with the Associate Director to run Cedar Gate’s security governance, risk, and compliance program, driving planning, execution, and reporting across compliance, audit, risk, and customer assurance workstreams.\n\nAdminister annual SOC 1 and SOC 2 audits and HITRUST r2 and interim assessments, coordinating evidence requests, interviews, and walkthroughs between auditors and internal control owners, and driving gap resolution and escalations.\n\nManage audit vendor relationships in partnership with the Associate Director, including vendor selection, contracts, deliverables, and payment.\n\nOversee the execution and quality of recurring compliance controls performed by the Nepal operations team, including logical and physical access reviews, termination reviews, elevated access reviews, backup validation, patching compliance audits, and the annual facility security audit — reviewing results, identifying gaps, and escalating issues to resolution.\n\nOversee data protection controls, including monthly data destruction sample audits, review and issuance of data destruction certificates for clients, and DLP reviews of PHI activity across AWS WorkSpaces users.\n\nSupport client security reviews, questionnaires, and audit-related communications, including executing SOC 2 NDAs and distributing SOC reports to clients and prospects.\n\nMature the enterprise risk program, maintaining the risk register, leading interview-based risk assessments, managing risk exceptions, and tracking treatment and remediation plans with accountable owners.\n\nDeliver regular risk reporting to Cedar Gate and IQVIA leadership on risk register changes, results, and trends, alongside metrics on control effectiveness and audit status.\n\nLead the annual business impact analysis and maintain business continuity and disaster recovery plans, assessing new products and updating plans for existing ones.\n\nDevelop, review, and update security policies and procedures in partnership with the Associate Director, coordinating stakeholder input and approvals.\n\nOversee third-party risk management for Tier 1 Cedar Gate vendors, including annual reviews of vendor security posture.\n\nCoordinate same-day response to significant audit findings, emerging security risks, compliance issues, and customer-driven requests across multiple stakeholders.\n\nSupport integration by aligning Cedar Gate controls, policies, and evidence processes with IQVIA frameworks, and contribute to broader IQVIA governance, risk, and compliance initiatives as integration progresses.\n\nRequired Experience and Qualifications\n5–8 years of experience in security governance, risk and compliance, IT audit, or security compliance roles.\n\nHands-on experience administering SOC 1 and SOC 2 audits, including evidence management, auditor coordination, and control owner walkthroughs.\n\nHands-on experience with HITRUST CSF assessments, ideally including r2 and interim assessments.\n\nExperience operating or testing IT general controls, including access reviews, termination and elevated access processes, patch management, backup, and data destruction.\n\nExperience building or maturing an enterprise or IT risk management program, including risk registers, interview-based risk assessments, exception processes, and remediation tracking.\n\nExperience with business impact analysis, business continuity, and disaster recovery planning.\n\nExperience supporting customer assurance activities such as security questionnaires, client audits, and SOC report distribution.\n\nExperience with third-party risk management and vendor security assessments.\n\nWorking knowledge of HIPAA/HITECH requirements and PHI handling controls.\n\nExperience overseeing work performed by offshore or distributed teams without direct reporting lines, including quality review, follow-up, and escalation.\n\nFamiliarity with cloud environments, preferably AWS, and common security controls such as DLP and endpoint protection.\n\nStrong organizational and program management skills, with the ability to run a recurring control calendar and multiple concurrent audits against firm deadlines.\n\nAbility to work credibly with executives, auditors, clients, and control owners, and to drive decisions on sensitive findings and risk treatment.\n\nExperience in healthcare, health technology, or other regulated environments is preferred.\n\nBachelor’s degree in Information Security, Information Systems, Business, or equivalent practical experience is preferred.\n\nRelevant certifications such as CISA, CISSP, CRISC, or HITRUST CCSFP are preferred.\n\nIQVIA is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at \nIQVIA is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other status protected by applicable law. \nIQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.\nThe potential base pay range for this role, when annualized, is $90,200.00 - $225,600.00. The actual base pay offered may vary based on a number of factors including job-related qualifications such as knowledge, skills, education, and experience; location; and/or schedule (full or part-time). Dependent on the position offered, incentive plans, bonuses, and/or other forms of compensation may be offered, in addition to a range of health and welfare and/or other benefits.\n\nThis job is curated by Lifelancer.Lifelancer is a talent-hiring platform in Life Sciences, Pharma and IT. The platform connects talent with opportunities in pharma, biotech, health sciences, healthtech and IT domains.\nPlease apply via Lifelancer platform to get connected to the application page and to find similar roles.\nOriginally posted on Himalayas","description_format":"text","description_chars":8378,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Biotechnology","Health Care","Internet Services"],"lifecycle":[{"event":"open","at":"2026-10-25T02:28:15Z"}],"visa":[],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.844,"p_room":0.9,"age_days":10,"expected_fill_days":29,"reasons":["seen:10","velocity","win:mid","comp:brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":{"stated_usd_annual":225600,"is_top_pay":true},"html_url":"https://alion.io/job/lifelancer-manager-security-governance-risk-compliance","json_url":"https://alion.io/job/lifelancer-manager-security-governance-risk-compliance.json","meta":{"generated_at":"2026-11-04T22:20:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":669,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3853997},"rest":"https://alion.io/mcp/rest/get_company?id=3853997"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flifelancer-manager-security-governance-risk-compliance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flifelancer-manager-security-governance-risk-compliance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flifelancer-manager-security-governance-risk-compliance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lifelancer-manager-security-governance-risk-compliance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flifelancer-manager-security-governance-risk-compliance"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3220069}},{"tool":"search_jobs","arguments":{"company":"lifelancer.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3220069},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}