Job Functions, Duties, Responsibilities and Position Qualifications:We're not just a workplace - we're a Great Place to Work certified employer!Proudly certified as a Great Place to Work, we are dedicated to creating a supportive and inclusive environment. At Sonic Healthcare USA, we emphasize teamwork and innovation. Check out our job openings and advance your career with a company that values its team members!JOB SUMMARYTheCyber Governance & Risk Manager (GRC Manager)is a key member of the Cyber Security Team, responsible for establishing and managing a robust governance framework, overseeing risk management processes, conducting internal audits, and ensuring compliance with industry and healthcare-specific regulatory standards. This role also chairs theInformation Security Management Committeeand collaborates cross-functionally to implement ethical and secure practices throughout the organization.The role includes:Providing advice and interpretation on the company’s code of conduct, security compliance policies, relevant health industry regulations, and industry codesRecommending changes to corporate security compliance policies and practices to ensure consistency with laws, regulations, and industry standardsMaintaining up-to-date knowledge of relevant healthcare and other related compliance rules, regulations, enforcement trends, and industry standardsProviding strategic and tactical advice to stakeholders to ensure compliance and security.Proactively identifying, mitigating, and managing incidents and vulnerabilities.Ensuring ethical business conduct through the effective implementation of industry and company standards.DUTIES AND RESPONSIBILITIESLead the development and implementation of a GRC program aligned withISO 27001,SOC 2, andNISTcybersecurity frameworks.Conduct internal audits and risk assessments across IT systems, clinical operations, and third-party vendors; maintain audit schedules and reports.Implement and maintain anInformation Security Management System (ISMS)in accordance with ISO 27001 standards.Evaluate and strengthen internal controls protecting PHI, PII, and financial data in alignment with HIPAA, PCI DSS, and CLIA/CAP requirements.Maintain a risk register and document risk treatment plans, audit results, findings, and remediation actions.Provide strategic advice to stakeholders on compliance, governance, and information security best practices.Align policies and procedures with global standards, recommending updates in response to new laws, technologies, and risks.Act as a liaison with regulatory bodies and certification auditors; prepare audit documentation and coordinate responses.Develop training and awareness programs across the organization on security, compliance, and ethical conduct.Ensure effective incident detection, investigation, response, and prevention strategies.WORK ENVIRONMENT AND PHYSICAL REQUIREMENTSOffice and clinical laboratory environments; occasional weekend or off-hours work may be required.May require lifting equipment (30–50 pounds), standing or walking for extended periods, and travel between sites.Use of standard and specialized cybersecurity tools and IT systems.MINIMUM QUALIFICATIONSBachelor’s degree in Information Security, Information Technology, Compliance, or related field ( or equivalent experience)Minimum5yearsof applied experience in cybersecurity governance, audits, risk, remediation, or compliance.Minimum of 2 years managing a GRC Program\TeamExperience conducting and leadinginternal audits.In-depth knowledge ofISO 27001,SOC 2, andNIST frameworks.Familiarity with HIPAA, CLIA, CAP, and healthcare industry regulations.Strong understanding of GRC tools and methodologies.Ability to travel occasionally and work flexible hours during high-impact events or audits.PREFERRED CERTIFICATIONSCISA, CISM, CRISC, CISSP, or ISO 27001 Lead Auditor certification preferred.KNOWLEDGE, SKILLS, AND ABILITIESStrong analytical and problem-solving skills.Exceptional written and verbal communication skills with the ability to explain technical topics to non-technical audiences.Proficiency with risk management, GRC platforms, security control frameworks, and incident response.Ability to develop security strategy, manage audits, and report on compliance to executives and committees.High ethical standards and a proactive, service-oriented approach to stakeholder engagement.Ability to work independently, handle sensitive information, and maintain confidentiality under pressure.Scheduled Weekly Hours:40Work Shift:Job Category:Information TechnologyCompany:Sonic Healthcare USA, IncSonic Healthcare USA is an equal opportunity employer that celebrates diversity and is committed to an inclusive workplace for all employees. We prohibit discrimination and harassment of any kind based on race, color, sex, religion, age, national origin, disability, genetics, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.