IT Security Supervisor, GRC

Location: San Francisco, CA, United States

The Head of Governance, Risk, and Compliance (GRC), supports the Manager of Cyber Risk Management with their expert knowledge of cybersecurity risk management, contractual and regulatory compliance, and security control frameworks to analyze and manage risk institution-wide security issues across UCSF Health, Campus, Foundation, and affiliated environments. Serves as functional leader for GRC team and directs day-to-day execution of enterprise cyber risk and compliance services. Provides sustained staff direction, work prioritization, mentoring, training, escalation handling, and quality oversight across complex risk assessments, including AI solutions; security exceptions; policy interpretation; contract reviews, third-party reviews; and enterprise compliance activities, including PCI-DSS, HIPAA, UC policy, and NIST-based frameworks. Leads projects and program improvements with organization-wide impact, including IRM and IT Service Management workflows, metrics, training, quality controls, and operating standards. Employ AI solutions to increase service capacity and accelerate delivery. Regularly interfaces with senior stakeholders, auditors, and business owners and provides expert guidance and operational direction to team members. Works with the UC Office of the President and other UC campuses on system-wide initiatives. The proposed IT Security Supervisor 2 classification reflects the closest available title for a role that now carries sustained staff direction, program accountability, and enterprise operational leadership responsibilities.

Department Overview

UCSF Cybersecurity protects and responds to both internal and external threats. It monitors vulnerabilities, risks, and exposures and mitigates issues prior to exploitation. If an incident does occur, IT Security investigates, determines impact, and recommends controls for reduced recurrence likelihood.

• Vulnerability Management
• Network Security
• Data security and protection
• Security architecture and design review
• Incident response and forensic analysis
• Cyber threat intelligence
• Threat hunting and event analysis
• Establishing policies and standards for information security
• Conducting security risk assessments of systems, solutions, and vendors
• Governance, risk, and compliance
• Architecting secure business solutions
• Outreach and security awareness training and education
• Endpoint security, including encryption, anti-malware, endpoint detection and response
• Application security
• E-Discovery and forensic services

About Us