Vice President, Governance, Risk & Compliance

Job Description: The Vice President, Governance, Risk & Compliance (GRC) is responsible for establishing, implementing and maturing an enterprise-wide GRC program across a complex, multi-program organization. This executive leader develops the GRC strategy and roadmap, creates sustainable governance structures, standardizes risk and compliance practices, and provides leadership and the Board with clear visibility into significant risks, mitigation activities and compliance performance. The Vice President serves as the central coordinator and transformation leader for GRC, moving the organization from decentralized and siloed compliance routines to an integrated, risk-based operating model. The role partners closely with executive leadership, program operations, Legal, Finance, Human Resources, Information Technology, Quality and other stakeholders to strengthen accountability, transparency and a culture of risk awareness. Qualifications: Bachelor’s Degree in Business Administration, Healthcare Administration, Risk Management, Law, Finance, Accounting, Public Administration, Compliance or a Related Field, required. Master’s Degree in Business Administration, Healthcare Administration, Law, Public Administration, or a Related Field, preferred. At least 10 years of progressively responsible experience in compliance, enterprise risk management, governance, audit, quality, legal, privacy or a related discipline, including significant leadership responsibility, required. Demonstrated experience designing, implementing or materially maturing an enterprise GRC or enterprise risk management program, required. Experience leading cross-functional transformation in a complex or highly regulated organization, required. Strong knowledge of governance practices, risk assessment, compliance program management, internal controls, monitoring, investigations, audits and corrective action management, required. Demonstrated ability to communicate effectively with executive leadership, governing boards, regulators and operational stakeholders, required. Demonstrated experience using data, dashboards, metrics, and technology-enabled solutions to monitor enterprise risks, identify trends, and support executive and Board decision-making. Working knowledge of the COSO Enterprise Risk Management Framework and ability to translate complex regulatory and risk concepts into clear priorities and practical operating requirements, required. Experience in healthcare, behavioral health human services, nonprofit services, government-funded programs or another highly regulated environment, preferred. Professional certification such as CCEP, CHC, CRISC, CGEIT, CISA, CIA, CRM, CRMA, CHIAP, or RIMS-CRMP, preferred. Familiarity with information technology, cybersecurity, data governance, and privacy risk sufficient to incorporate technology-related risks into the enterprise risk management and reporting process, preferred. Experience selecting, implementing or optimizing GRC technology and reporting capabilities, including, but not limited to, demonstrated experience using the COSO ERM Framework, preferred. Experience with regulatory, accreditation and contractual requirements across multiple business or service lines, including HIPAA where applicable to programs and services, preferred. Valid driver’s license and reliable transportation. Essential Responsibilities: Enterprise Governance Establish and maintain the enterprise GRC framework, governance model and multi-year maturity roadmap. Define decision rights, roles, accountabilities, committee structures, charters and escalation paths. Create consistent policies, standards and operating practices for governance, risk and compliance activities. Facilitate enterprise governance forums and coordinate executive and Board-level oversight activities. Promote alignment among organizational strategy, regulatory obligations, risk appetite and operational priorities. Enterprise Risk Management Design and implement a formal enterprise risk management program using a recognized risk management framework. Establish consistent methods for risk identification, assessment, prioritization, response, monitoring and reporting. Lead recurring enterprise and program-level risk assessments and maintain an enterprise risk register. Partner with risk owners to develop mitigation plans, assign accountability, establish target dates and monitor progress. Develop risk appetite and tolerance recommendations for executive and Board review. Identify emerging and interconnected risks and communicate their potential organizational impact. Compliance Program Leadership Develop and oversee an integrated governance, risk and compliance program addressing applicable legal, regulatory, contractual, accreditation, privacy, ethical and internal policy requirements. Create an enterprise inventory of governance, risk and compliance obligations, accountable owners, monitoring activities and reporting requirements. Standardize governance, risk and compliance assessments, monitoring routines, documentation and evidence requirements across programs. Coordinate regulatory examinations, external audits, accreditation reviews and organizational responses, as appropriate. Oversee corrective action planning, issue escalation and remediation tracking. Monitor relevant regulatory and industry developments and coordinate assessment of organizational impact. Strategic Roadmap Execution Translate the GRC strategy into a prioritized implementation plan with defined workstreams, milestones, owners, dependencies and measures of success. Lead cross-functional teams responsible for executing roadmap initiatives. Balance regulatory urgency, organizational risk, operational capacity and change readiness when sequencing initiatives. Report roadmap status, accomplishments, constraints and decisions needed to executive leadership and governing bodies. Continuously assess GRC maturity and recommend adjustments to the roadmap. Monitoring, C