GRC Program Lead (AI)

Location: Menlo Park, California, United States; work arrangement: On-site

Company

Hippocratic AI is building a healthcare-only, safety-focused large language model designed to improve patient outcomes.

What you will do

• Own and scale governance, risk, and compliance programs covering SOC 2, HITRUST, HIPAA, ISO 42001, data de-identification, and applicable healthcare regulations.
• Lead international privacy and regulatory readiness, including GDPR, UK GDPR, cross-border transfers, data residency, the EU AI Act, and local healthcare requirements.
• Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence.
• Manage enterprise risk, vendor and fourth-party assessments, DPIAs, privacy documentation, risk registers, and quarterly risk reviews.
• Lead external audits, customer security assessments, questionnaires, RFP responses, TPRM renewals, presentations, and executive briefings.
• Own the Vanta trust center, compliance dashboards, metrics, remediation processes, training, and tabletop exercises.

Requirements

• Bachelor’s degree and 5+ years of experience in GRC, compliance, or audit, ideally in healthcare or a payor environment.
• Strong working knowledge of HIPAA, HITRUST, SOC 2, and ISO 42001.
• Experience with international data protection, GDPR, UK GDPR, cross-border transfers, data residency, and operational privacy controls.
• Hands-on experience with customer security assessments, TPRM portals, Vanta or similar GRC tooling, audits, and vendor risk reviews.
• Strong analytical, problem-solving, presentation, communication, and cross-functional collaboration skills.
• AI skills and examples of AI use; startup experience and the ability to work with ambiguity and minimal supervision.

Nice to have

• FedRAMP High, GovCloud, NIST SP 800-53 / 800-171, or federal customer authorization experience.
• Pharma or life-science experience with GxP, GAMP 5, CSV, 21 CFR Part 11, ALCOA+, SaMD, or ISO 13485.
• Privacy certifications such as CIPP/E, CIPP/US, or CIPM, plus ISO 27001 / 27701 experience.
• Familiarity with emerging AI governance regulations such as the EU AI Act.

Culture & Benefits

• Work with physicians, hospital leaders, AI researchers, and technology experts focused on healthcare safety.
• Collaborate across Sales, Engineering, DevOps, Clinical, Legal, administrative, and technical teams.
• Support a culture of compliance through targeted patient privacy, data security, and regulatory training.
• Join a company backed by leading healthcare and AI investors and funded through a $126M Series C round.