Manager, Security Governance, Risk & Compliance

The Manager, Security Governance, Risk & Compliance is a hands-on program leadership role supporting the security governance, risk, and compliance program for Cedar Gate Technologies, a healthcare technology business recently acquired by IQVIA. The role reports to the Associate Director responsible for Cedar Gate security and works in close partnership with that leader to run and mature a program that directly supports client trust, audit commitments, and revenue.

Cedar Gate maintains SOC 1, SOC 2, and HITRUST r2 certifications and supports a steady flow of client security reviews, questionnaires, and audit requests. This role oversees the execution of recurring compliance controls — performed largely by an operations team in Nepal — and leads the programs built around them: audit administration, customer assurance, enterprise risk, business continuity, policy, and third-party risk.

A core near-term priority is rebuilding and maturing the enterprise risk program, including interview-driven risk assessments, business impact analyses, disaster recovery planning, and risk exception management with business owners, application leaders, and remediation teams. As integration with IQVIA progresses, the role will help align Cedar Gate’s program with IQVIA’s security and compliance frameworks and expand to support the broader Information Security organization. You will sit within the global Information Security organization, working closely with Cedar Gate IT, product, business operations, and leadership teams, the Nepal operations team, external auditors, and clients.

Principal responsibilities will include:

• Partner with the Associate Director to run Cedar Gate’s security governance, risk, and compliance program, driving planning, execution, and reporting across compliance, audit, risk, and customer assurance workstreams.

• Administer annual SOC 1 and SOC 2 audits and HITRUST r2 and interim assessments, coordinating evidence requests, interviews, and walkthroughs between auditors and internal control owners, and driving gap resolution and escalations.

• Manage audit vendor relationships in partnership with the Associate Director, including vendor selection, contracts, deliverables, and payment.

• Oversee the execution and quality of recurring compliance controls performed by the Nepal operations team, including logical and physical access reviews, termination reviews, elevated access reviews, backup validation, patching compliance audits, and the annual facility security audit — reviewing results, identifying gaps, and escalating issues to resolution.

• Oversee data protection controls, including monthly data destruction sample audits, review and issuance of data destruction certificates for clients, and DLP reviews of PHI activity across AWS WorkSpaces users.

• Support client security reviews, questionnaires, and audit-related communications, including executing SOC 2 NDAs and distributing SOC reports to clients and prospects.

• Mature the enterprise risk program, maintaining the risk register, leading interview-based risk assessments, managing risk exceptions, and tracking treatment and remediation plans with accountable owners.

• Deliver regular risk reporting to Cedar Gate and IQVIA leadership on risk register changes, results, and trends, alongside metrics on control effectiveness and audit status.

• Lead the annual business impact analysis and maintain business continuity and disaster recovery plans, assessing new products and updating plans for existing ones.

• Develop, review, and update security policies and procedures in partnership with the Associate Director, coordinating stakeholder input and approvals.

• Oversee third-party risk management for Tier 1 Cedar Gate vendors, including annual reviews of vendor security posture.

• Coordinate same-day response to significant audit findings, emerging security risks, compliance issues, and customer-driven requests across multiple stakeholders.

• Support integration by aligning Cedar Gate controls, policies, and evidence processes with IQVIA frameworks, and contribute to broader IQVIA governance, risk, and compliance initiatives as integration progresses.

Required Experience and Qualifications

• 5–8 years of experience in security governance, risk and compliance, IT audit, or security compliance roles.

• Hands-on experience administering SOC 1 and SOC 2 audits, including evidence management, auditor coordination, and control owner walkthroughs.

• Hands-on experience with HITRUST CSF assessments, ideally including r2 and interim assessments.

• Experience operating or testing IT general controls, including access reviews, termination and elevated access processes, patch management, backup, and data destruction.

• Experience building or maturing an enterprise or IT risk management program, including risk registers, interview-based risk assessments, exception processes, and remediation tracking.

…