IT Risk and Compliance Manager
Read straight from University of Colorado's careers page, verified 21h ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
Salary$93k – $124k
LocationUnknown
Also inUniversity of Colorado Anschutz (Denver/Aurora, Colorado)
Work modehybrid
Typefull-time
SeniorityLead
Experience4–6 yrs
DepartmentInformation Strategy and Services
Company size10,000+ people
First seenNov 3, 2026 · 21h ago
Verified live21h ago
At a glanceSummarised by Seekless from the posting.
Bachelor's degree in Information Systems, Computer Science, Engineering, Business, Education, or a closely related field
4-6 years of relevant experience in information technology, information security, risk management, regulatory compliance, or related functions
Experience with third-party technology risk management and security assessments of university-operated or vendor-provided systems, applications, cloud services, or emerging technologies
Experience in collaboration on cross-functional IT security, risk, or compliance projects
Experience with implementation or administration of governance, risk, and compliance (GRC) platforms, workflow automation, reporting dashboards, or related technologies
Experience in administration or support of IT risk and compliance functions in higher education, academic research, healthcare, an academic medical center, or a similarly complex environment
2 years of management experience, including responsibility for leading professional or technical staff, managing priorities and workloads, and overseeing team operations and performance
Experience managing IT risk, information security, or compliance programs or services within a large, complex organization, preferably in higher education, academic research, healthcare, or an academic medical center
Experience developing, administering, or managing HIPAA Security compliance programs
Experience establishing, administering, or maintaining PCI DSS or other regulatory compliance programs
Experience with third-party technology risk, security assessments, and cross-functional IT security or compliance initiatives
Experience implementing or administering governance, risk, and compliance (GRC) platforms, workflow automation, reporting dashboards, or related technologies
Experience developing and maintaining information security policies, standards, procedures, and related compliance documentation
Experience supporting federally funded research, regulated research data, or secure computing environments
Relevant professional certification such as CISSP, CISA, CISM, CRISC, CGRC, HCISPP, GIAC, or a comparable security, risk management, audit, or compliance certification
Applicants must be legally authorized to work in the United States without requiring sponsorship
Skills
GRC platforms
NIST SP 800-171
NIST SP 800-53
HIPAA
PCI DSS
FERPA
GLBA
FISMA
CMMC
Benefits
Health insurance
Dental insurance
Life insurance
Vision insurance
Retirement 401a
Paid time off
Vacation days
Sick days
Holiday days
Tuition benefit
Eco pass
University of Colorado Anschutz
Department: Information Strategy and Services
Job Title: IT Risk and Compliance Manager
Position #: 00002161 – Requisition #: 41601
Job Summary:
Does This Describe You? Are you an experienced IT risk and compliance leader who enjoys turning complex regulatory requirements into practical solutions? Do you thrive in a collaborative environment where you can lead a talented team, modernize services, and help stakeholders make informed technology decisions? Information Strategy and Services (ISS) is seeking an IT Risk and Compliance Manager to lead university-wide IT risk and compliance operations supporting the University of Colorado Anschutz Medical Campus and the University of Colorado Denver. This position combines people leadership, technical expertise, strategic planning, and partnership to protect university data and technology while supporting the university’s missions. We are looking for an inclusive leader to manage our IT Risk and Compliance team, reduce university risk, and ensure compliance with requirements such as HIPAA, FERPA, PCI, and FISMA. If you think you have what it takes to lead this team, we want to know more about YOU! What You’ll Do * Lead and develop a team of IT risk and compliance professionals, setting priorities, managing workloads and performance, and supporting professional growth. * Lead the university’s IT risk and compliance program, including risk assessments, regulatory compliance, policy development, monitoring, reporting, and continuous improvement. * Oversee risk and compliance assessments for university and third-party systems, applications, cloud services, AI technologies, and other technologies, ensuring risks, requirements, controls, and recommended treatments are documented. * Build partnerships across the university to identify and address IT risk and compliance needs with researchers, healthcare partners, technology teams, legal counsel, privacy, procurement, administrators, and other stakeholders. * Strengthen technology and vendor security practices, including reviewing contracts and cloud service agreements and addressing security requirements and identified risks. * Modernize IT risk and compliance services by implementing GRC tools, improving workflows, and using monitoring, metrics, and reporting to improve service delivery. What Success Looks Like * The IT risk and compliance team has clear priorities, service expectations, and opportunities for professional growth. * University stakeholders receive practical, timely guidance to understand and address technology risks and compliance requirements. * Security and compliance risks are consistently identified, documented, assigned, monitored, and addressed. * Risk and compliance services become more efficient, responsive, scalable, and easier to navigate. * Compliance programs, policies, assessments, risk registers, and reporting remain organized, current, and aligned with university and ISS priorities. * The manager builds trusted relationships across technical, research, clinical, legal, privacy, procurement, and administrative functions. What You’ll Bring * Strong leadership and operational management skills, including team development, performance management, workload planning, and service oversight. * Advanced knowledge of IT risk management, information security, regulatory compliance, security controls, and risk mitigation. * Experience interpreting and applying requirements such as HIPAA, PCI DSS, FERPA, GLBA, NIST, FISMA, or CMMC. * Ability to translate technical, regulatory, and risk information into clear, practical guidance for varied audiences. * Strong analytical, communication, decision-making, project management, and relationship-building skills. * A collaborative, accountable, and service-oriented leadership approach focused on technical excellence and continuous improvement.
Work Location:
Hybrid –ISS supports a flexible work environment while recognizing the value of in-person collaboration. This position requires a minimum of three days per week on campus, with additional in-person presence as needed for meetings, activities, collaboration engagements, or operational needs. The work schedule will be based around core working hours in Colorado Mountain Time.
Why Join Us:
Information Strategy and Services (ISS) partners across the campus to deliver information technology services that empower teaching, learning, research, and patient care. ISS brings together expertise across four key areas: Technology & Infrastructure, Security & Compliance, Information & Data Enablement, and Business Strategy. Together, we [connect service and technology](https://nam02.safelinks.protection.outlook.com/?url=https://www.cuanschutz.edu/offices/iss/about-us&data=05
Qualifications:
Minimum Qualifications: Education: * Bachelor’s degree in Information Systems, Computer Science, Engineering, Business, Education, or a closely related field + Substitution: 4 years of professional or high-level technical work experience may be substituted for the bachelor’s degree. An associate’s degree with two years of relevant work experience may be substituted for the bachelor’s degree Experience: * 4-6 years of relevant experience in information technology, information security, risk management, regulatory compliance, or related functions. Experience must include: + Third-party technology risk management and security assessments of university-operated or vendor-provided systems, applications, cloud services, or emerging technologies, including contractual security compliance. + Collaboration on cross-functional IT security, risk, or compliance projects. + Implementation or administration of governance, risk, and compliance (GRC) platforms, workflow automation, reporting dashboards, or related technologies. + Administration or support of IT risk and compliance functions in higher education, academic research, healthcare, an academic medical center, or a similarly complex environment, including collaboration with faculty, researchers, healthcare professionals, administrators, or other clientele. * 2 years of management experience, including responsibility for leading professional or technical staff, managing priorities and workloads, and overseeing team operations and performance. Applicants must meet minimum qualifications at the time of hire. Preferred Qualifications: * Experience managing IT risk, information security, or compliance programs or services within a large, complex organization, preferably in higher education, academic research, healthcare, or an academic medical center. * Experience developing, administering, or managing HIPAA Security compliance programs, including applying HIPAA Security requirements within information security, IT risk management, or compliance functions. * Experience establishing, administering, or maintaining PCI DSS or other regulatory compliance programs. * Experience with third-party technology risk, security assessments, and cross-functional IT security or compliance initiatives, including collaboration with technical and non-technical stakeholders. * Experience implementing or administering governance, risk, and compliance (GRC) platforms, workflow automation, reporting dashboards, or related technologies. * Experience developing and maintaining information security policies, standards, procedures, and related compliance documentation. * Experience supporting federally funded research, regulated research data, or secure computing environments. * Relevant professional certification such as CISSP, CISA, CISM, CRISC, CGRC, HCISPP, GIAC, or a comparable security, risk management, audit, or compliance certification. Conditions of Employment: * Applicants must be legally authorized to work in the United States without requiring sponsorship. We are unable to provide work visa sponsorship or employment authorization for this position now or in the future. Knowledge, Skills and Abilities: * Knowledge of creating or managing a HIPAA security compliance program. * Knowledge of establishing and maintaining a PCI DSS compliance program. * Knowledge of developing information security policies, standards, and procedures. * Knowledge of supporting federally funded research, regulated research data, or secure computing environments. * Leadership and management skills, including staff supervision, performance management, team development, and operational oversight. * Experience managing IT risk and compliance programs, services, and operations within a large, complex organization. * Technical knowledge of information security principles, enterprise technologies, security controls, vulnerabilities, and risk mitigation practices. * Experience applying IT security and compliance principles in operational technology environments, evaluating security controls, identifying risks, and recommending practical remediation. * Knowledge of regulatory requirements and security frameworks, including FERPA, HIPAA, GLBA, PCI DSS, NIST SP 800-171, NIST SP 800-53, FISMA, and CMMC. * Experience conducting and overseeing IT risk assessments, compliance analyses, risk registers, compliance monitoring, and audit tracking. * Knowledge of regulated research environments, sensitive data requirements, and secure computing practices. * Knowledge of GRC platforms and experience evaluating tools that support risk assessments, compliance management, reporting, and operational efficiency. * Project management, process modernization, and organizational change-management skills. * Analytical, communication, problem-solving, and decision-making skills, including the ability to align risk and compliance activities with university, IT, and Information Security and Compliance program goals.
How to Apply:
We value the thoughts you put into a Cover Letter and would like to see your Resume, and List of References. For full consideration, please submit the following document(s): 1. A letter of interest describing relevant job experiences as they relate to listed job qualifications and interest in the position 2. Resume 3. Three to five professional references, including name, address, phone number (mobile number if appropriate), and email address Questions should be directed to: ISS Human Resources [email protected]
Screening of Applications Begins:
Immediately and continues until position is filled. For best consideration, apply by 11/18/2026.
Anticipated Pay Range:
The starting salary range (or hiring range) for this position has been established as $92,804 - $124,358 The above salary range (or hiring range) represents the University’s good faith and reasonable estimate of the range of possible compensation at the time of posting. This position may be eligible for overtime compensation, depending on the level. Your total compensation goes beyond the number on your paycheck. The University of Colorado provides generous leave, health plans and retirement contributions that add to your bottom line. Total Compensation Calculator
Equal Employment Opportunity Statement:
CU is an Equal Opportunity Employer and complies with all applicable federal, state, and local laws governing nondiscrimination in employment. We are committed to creating a workplace where all individuals are treated with respect and dignity, and we encourage individuals from all backgrounds to apply, including protected veterans and individuals with disabilities.
ADA Statement:
The University will provide reasonable accommodations to applicants with disabilities throughout the employment application process. To request an accommodation pursuant to the Americans with Disabilities Act, please contact the Human Resources ADA Coordinator at [email protected].
Background Check Statement:
The University of Colorado Anschutz is dedicated to ensuring a safe and secure environment for our faculty, staff, students and visitors. To assist in achieving that goal, we conduct background investigations for all prospective employees.
Vaccination Statement:
CU Anschutz strongly encourages vaccination against the COVID-19 virus and other vaccine preventable diseases. If you work, visit, or volunteer in healthcare facilities or clinics operated by our affiliated hospital or clinical partners or by CU Anschutz, you will be required to comply with the vaccination and medical surveillance policies of the facilities or clinics where you work, visit, or volunteer, respectively. In addition, if you work in certain research areas or perform certain safety sensitive job duties, you must enroll in the occupational health medical surveillance program.