Rochester Regional Health

Lead GRC program activities including third-party risk, compliance audits, policy development, risk assessments, and business continuity planning. | Minimum 5 years leading GRC programs, proficiency in ISO 27001, bachelor's degree preferred, strong analytical and communication skills. | Job Title: Governance Risk & Compliance Manager Department: Information Security Location: Remote, United States Schedule: Days, Monday - Friday SUMMARY The Governance, Risk & Compliance [GRC] Manager at ACM Global Laboratories translates strategic direction into actionable workflows, coordinates cross-functional teams, supports evidence lifecycle management, maps frameworks to control implementation, leads readiness activities, and ensures all ACM GRC processes operate smoothly and efficiently. RESPONSIBILITIES Leads the GRC program activities and a team of professionals related to third-party risk, security internal audit, security compliance, and ISMS program management. Develop, document, and implement internal policies and procedures to ensure compliance with industry standards and legal requirements. Facilitate regular risk assessments against security frameworks such as SOC 2, ISO 27001, and PCI-DSS, maintain a risk register, and collaborate on mitigation strategies for identified threats. Manage CAPAs for non-compliance. Define specific, assignable actions to mitigate the identified risks or exploit the opportunities. Evaluate how to embed the planned actions directly into daily operational processes. Manage security responses to client questions and questionnaires, including RFPs, RFIs, annual risk reviews, and ad-hoc communication requests. Manage and update business continuity and disaster recovery documentation, including BIAs, plan revisions, team rosters, and dependencies. Plan, coordinate, and document annual exercises, such as tests, tabletops, and other exercises. Build and manage a security metrics (KPI’s) program. Develop relationships with cross-functional teams, understanding their needs in relation to security standards, to drive risk-informed decision-making and build a culture of compliance. Provide expert guidance and support in navigating complex regulatory environments in relation to the management of alignment to ISO-27001 and other applicable security frameworks. Stay updated on applicable industry trends and regulations to ensure ISMS compliance. Monitor and analyze GRC processes and systems, making recommendations for improvement. Document risk reduction plan. Annually, document “Opportunities” (potential positive improvements like adopting some technology for improved efficiency). Other duties as assigned. REQUIRED QUALIFICATIONS Minimum of 5 years of experience leading Governance, Risk, and Compliance (GRC) programs. Proficiency in ISO 27001 PREFERRED QUALIFICATIONS GRC certifications (e.g. CGRC, CRISC, etc) A bachelor’s degree in IT, cybersecurity, business, or law is preferred, or strong demonstrable background in GRC Management. Previous experience in GRC, risk management, or internal audit, often with a mid-level leadership background. Proficiency in frameworks like SOC2, NIST CSF, and HIPAA regulations. Strong ability to analyze risk data and translate complex regulations into actionable controls. Excellent communication skills to interact with stakeholders and lead team efforts. Experience with 3rd party/vendor risk management processes. Experience in working with sales teams to complete Requests for Proposals and security questionnaires. Understanding of GRC processes such as policy management, risk assessment, and IT audits. Exceptional verbal and written communication skills. EDUCATION: LICENSES / CERTIFICATIONS: PHYSICAL REQUIREMENTS: L - Light Work - Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly; requires occasional walking, standing or squatting. For disease specific care programs refer to the program specific requirements of the department for further specifications on experience and educational expectations, including continuing education requirements. Any physical requirements reported by a prospective employee and/or employee’s physician or delegate will be considered for accommodations. PAY RANGE: $115,000.00 - $140,000.00 CITY: Rochester POSTAL CODE: 14624 The listed base pay range is a good faith representation of current potential base pay for a successful full time applicant. It may be modified in the future and eligible for additional pay components. Pay is determined by factors including experience, relevant qualifications, specialty, internal equity, location, and contracts. Rochester Regional Health is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, sex (including pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity or expression, national origin, age, disability, predisposing genetic characteristics, marital or familial status, military or veteran status, citizenship or immigration status, or any other characteristic protected by federal, state, or local law.

Lead IT validation, risk, change management processes ensuring regulatory compliance and oversee related staff and projects. | 10+ years in GxP IT validation and change management with 5+ years leadership experience, preferably with a master's degree and certifications. | Job Title: Director, IT Validation/Assurance, Risk & Change Management Department: Information Technology Location: Remote | United States Hours Per Week: 40 hours Schedule: Days, Monday – Friday SUMMARY The Director of IT Validation/Assurance. Risk and Change at ACM Global Laboratories is responsible for the strategy, planning and execution of the global Computer System’s IT validation/assurance and change management process ensure compliance with GXP, CFR, MOH, MHRA and industry best practice. Provides leadership to direct reports and other personnel who support global Computer Systems regulatory compliance, inclusive of lab equipment-related software. Interfaces with ACM QA, ePMO, Lab Services and others to help ensure all regulatory requirements related to IT system validation/assurance, testing and activation are met before system are put into production. Working with QA and the ePMO, ensure the development of comprehensive testing / activation and staff education planning is in place to support system go-lives. This position manages the process and staff to ensure system implementations are properly managed from a IT validation/assurance, testing, change control and documentation perspective to ensure IT compliance with GAMP 5, FDA 21 CFR Part 11, EU Annex 11, Data Integrity (ALCOA+) and other regulatory requirements. RESPONSIBILITIES • Working with IT and QA leadership and other departments , develops, reviews, modified, secures approvals and implements all IT validation, IT risk management, IT Change management SOPs ensuring that they and associated QA policies comply with all regulatory requirements (GXP, CFR, ISO, MHRA, MOH, HIPAA) and GAMP5 guidance. • Manages all IT organizational controls / structures related to computer system implementation / IT validation/assurance and Change management in alignment of GXP and computer Systems best practice guidelines. • Ensures that the alignment of Computer System IT validation/assurance and change management expectation to organization risk. Working with IT and QA, ensure the development and completion of necessary IQ, OP, PQ and UAT testing are completed and approved to support required system activation and CM requirements. • Work in conjunction with ACM QA leadership and the ACM PMO to ensure the development of comprehensive validation plans. • Operates as the IT oversight at Drugscan to ensure IT testing and change management for those non-regulated systems align to industry best practice. • Provides Computer Systems IT quality assurance oversight across the end-to-end product lifecycle for software development and validation/assurance lifecycle activities associated with regulated computerized systems (including lab equipment utilizing software) to ensure conformance to GxPs, guidance documents, applicable industry accepted standards. • Manage all IT department Computer Systems SOPs, policies, working instructions, training records, validation/assurance protocols and other controlled documents related to the delivery of compliant IT validation/assurance, risk management, testing and change management. • Responsible for programs and initiatives used to monitor and measure the overall quality of IT services, systems and software. • Ensures that tracking systems capture useful operational metrics for use in reducing defects, improving services and optimizing implementation process. • Work collectively with ACM QA to provide oversight of Computer Systems QA activities for projects involving GxP (Good Clinical Practice, Good Manufacturing Practice, Good Laboratory Practice) relevant computer systems. • Work closely with project team members across all relevant departments to incorporate appropriate elements of IT quality, IT compliance, and sound change management into the system lifecycle. • Provide management, guidance, documentation, and oversight of IT validation activities. • Review and approve computer system IT validation artifacts. • Provide leadership and tactical direction and guidance for changes to regulated computer systems. • Manage CAPAs, deviations, and audit responses related to IT work efforts. • Support internal and external compliance audits, including those with commercial clients and regulatory bodies. Coordinate audit preparation and response with all impacted departments. • Evaluate areas of risk in IT business processes at ACM and Drugscan. This assessment will be ongoing throughout the year as more information is discovered, or regulatory bodies change requirements. • Work collectively with IT security staff (ACM / RRH) to address identified IT security issues and to manage the over IT (ACM / DS) risk registry. • Experienced in staff development / engagement. • Develop a plan and coordinate the remediation of any audit or internal control findings identified by internal or external auditors. Work with both internal and external auditors to ensure remediation plan will satisfy all regulatory bodies. • Review new client and IT vendor contract requirements related to IT validation/assurance, risk management and change management to ensure alignment and communicate to the proper ACM staff of concerns. Engage in contract negotiations with clients/vendors to ensure their expectation align with the organization’s capabilities and regulatory requirements. • Digital Transformation & Automation - Responsible for the automation and departmental activities inclusive but not limited to Validation Lifecycle Management Systems, Testing automation and ITSM (change Management) systems. • Implement and manage validation automation platforms (e.g., Kneat, ValGenesis, Veeva). • Promote paperless validation and lifecycle digitization. • Drive innovation using AI/ML-assisted validation tools (where applicable), Test automation and continuous validation. • Implementation of change management systems (IVANTI) to drive paperless change request/ change management process / approvals. • Keep up with GXP and other auditing regulatory bodies’ changes to regulations and interpret new guidance and new accounting standards and how to apply them to the company. • Perform ad hoc IT risk assessments and drive improvements. • Escalate and communicate control deficiencies to systems and business owners as required. • Drives Change Management/Communication process and tools. • Hire, develop, train, and evaluate performance of Computer Systems Compliance staff. • Performs other duties as assigned REQUIRED QUALIFICATIONS • Bachelor’s degree required. • 10 years in GxP IT validation/assurance, IT quality, IT risk and change management. • 5 years of leadership experience PREFERRED QUALIFICATIONS • 12+ years in GxP IT validation/assurance, IT quality, IT risk and change management with substantial hands-on computer system validation/assurance experience, preferably in a central lab environment. • Master’s Degree preferred • Strong experience with, GAMP 5 and CS, Regulatory inspections, Enterprise systems (SAP, LIMS, MES, Veeva, etc.) • Demonstrated capability to select and execute optimal IT validation methods and techniques for obtaining results consistent with business goals. • Experienced in the development of Computer System Assurance process in alignment with FDA guidance with successful organization transition. • Experience in FDA regulated environment with demonstrated understanding of cGxP (cGMP, cGAMP, cGLP) standards and Risk based validation. • Experience in data privacy and security regulations (e.g. HIPAA and GDPR). • Demonstrated expertise in all computer-related aspects of GxP, including 21 CRF Part 11. • Experience in reviewing computer system validation/assurance artifacts, including system and user requirements, validation scripts and traceability matrix, system management plans and design specifications. • Experience in writing and executing documentation for all aspects of the IT validation/assurance deliverables (IT related compliance/validation plans, test protocols, validation summary reports and compliance/validation reports). • Expert knowledge and application of Computer System IT Validation/Assurance), IT Change Control and SOP development. • Demonstrated success managing personnel and vendors. • Excellent oral and written communication skills. • Effective interpersonal and leadership skills. • Demonstrated ability to work with others in a team environment. • CCMP (Certified Change Management Professional). • Computer System Validation certification. • Certified Software Quality Engineer (CSQE) preferred. • Experience implementing validation automation tools (Kneat, Veeva, ValGenesis, etc.). • Knowledge of cybersecurity in regulated environments. • Certifications (optional): PMP, ITIL, ASQ (CQA, CQE), ISPE / GAMP-related training EDUCATION: LICENSES / CERTIFICATIONS: PHYSICAL REQUIREMENTS: L - Light Work - Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly; requires occasional walking, standing or squatting. For disease specific care programs refer to the program specific requirements of the department for further specifications on experience and educational expectations, including continuing education requirements. Any physical requirements reported by a prospective employee and/or employee’s physician or delegate will be considered for accommodations. PAY RANGE: $165,000.00 - $185,000.00 CITY: Rochester POSTAL CODE: 14624 The listed base pay range is a good faith representation of current potential base pay for a successful full time applicant. It may be modified in the future and eligible for additional pay components. Pay is determined by factors including experience, relevant qualifications, specialty, internal equity, location, and contracts. Rochester Regional Health is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, sex (including pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity or expression, national origin, age, disability, predisposing genetic characteristics, marital or familial status, military or veteran status, citizenship or immigration status, or any other characteristic protected by federal, state, or local law.

Oversees administrative functions including finance, HR, facilities, and IT to ensure smooth daily operations and strategic goal achievement. | Bachelor's degree plus 3-5 years of experience in operations, program, or facility management required. | Job Title: Manager of Operations, College of Health Department: Operations Location: College of Health Careers 470 Skyview Centre Parkway Rochester, NY 14622 United States of America Hours Per Week: Full-Time 40 hours/week Schedule: M-F 8am-5pm SUMMARY: The role is responsible for multiple administrative functions, including finance, human resources, facility operations, property control, purchasing, and security. The role provides leadership, general direction, and administration of the college's facilities, maintenance, human resources, information technology, and custodial services and plays a critical role in ensuring the organization's day-to-day functions run smoothly and that strategic goals are met. This position is also responsible for the upkeep of the physical plant, including the extension site campuses, and for ensuring compliance with federal, state, and local agency’s standards and regulations. RESPONSIBILITIES: Matrix Leadership: Collaborates effectively across departments. Inspires and motivates others to work towards a shared vision. Adapts communication style to different audiences. Collaborates with others to navigate uncertainty and ambiguity. Delegates effectively, trusting team members by encouraging autonomy and ownership among team members. Fosters a culture of empowerment and accountability. Creates a positive and optimistic work environment. Establishes and nurtures valuable professional relationships May provide guidance, coordination, or oversight for team members to ensure consistent application of programs and practices. Operational Oversight: Provides leadership and general direction for the facilities, maintenance, safety and custodial services. Assists in the development of campus policies and procedures related to these functions. Assists in the development of campus policies and procedures related to these functions. Participates in the development and operations of facilities plans. Oversees record keeping and documentation for campus facilities including physical space inventory. Oversees the procurement process, including vendor selection, order placement, and delivery management. Consults with architects, engineers, and RRH departments in the planning and development of major new construction or renovation/refurbishment of facilities. Ensure all facility work is in compliance and is of high quality. Establishes procedures for the safe and efficient operation of the college's maintenance and custodial services operations. Recommends the allocation of space, furniture, and other physical resources. Oversees the organization's IT infrastructure and systems, including collaborating with the IT teams to implement technology solutions that support business and educational needs. Maintains inventory of furniture and machines and oversees delivery, storage, and deployment of these resources; works with IT to manage inventory of computers, AV, and other digital equipment. Oversees institutional logistics related to event management, transportation, etc. Works with campus leadership and staff in support of functions including but not limited to open houses, orientations, conferences. Financial Stewardship: Collaborates with the leadership and other campus leaders to prepare the capital improvement plan and capital budget requests for the campus. Develops operating budget requests and recommends priorities for departments and functions for which the position is responsible. Responsible for financial stewardship and planning. In collaboration with RRH, negotiates contracts and monitors expenditures to ensure that funds are effectively and appropriately used. Responsible for effective, efficient, and transparent operational and financial practices. Lead the budgeting, forecasting, and other financial planning processes. Analyze financial performance and recommend strategies to optimize financial position. Develop and maintain comprehensive documentation of budget and financial processes. Provide counsel on financial implications of strategic initiatives, growth, program development, and faculty hiring and retention. Collaborates on the monthly, quarterly, and annual financial close, including reconciliations, journal entries, and reporting. Oversee the procurement and purchasing, including requisitions, vendor set-up, and contract routing. Partners with Accounts Payable (AP) and Accounts Receivable (AR), ensuring timely invoice processing, collections, and vendor payments. Assists with setting up grant awards and grant budgets and maintains up-to-date electronic files of all contracts, awards, and grants. Ensures that grants and contract funding are allocated and expended appropriately and analyzes budget spending rates; forecasts year-end expenditures and fulfills financial reporting requirements. Quality and Safety: Continuously monitor and improve campus safety and security using a mixture of human interaction (RRH Security Officers, area police force.) and technology (mass notification system, access controls, cameras, etc.) Develop, implement, and coordinate emergency preparedness drills such as adverse weather and fire as well as man-made events such as active shooter threats. Provides for effective emergency or crisis response in matters related to campus facilities. Ensures that each employee receives basic and in-service training as required for campus safety and emergency response; Maintains liaison with the RRH Security to assure the safety of employees and students on campus Update and maintain policies and procedures relating to safety/security. Analyze intelligence concerning campus safety, provide timely reports to appropriate internal and external stakeholders regarding potential and actual safety and security concerns, and propose proactive and responsive measures to address such concerns. Maintain awareness of all applicable local, state, and federal laws related to campus safety and security in higher education. Regulatory Compliance Ensures the college and its programs meet the regulatory requirements. Develops and promotes structures, programs, policies, and procedures that enhance student success and campus safety. Serves as an arbiter for institutional policy enforcement and a final decision maker for grievances and complaints elevated as necessary. Ensures financial accountability, transparency, and efficiency. Ensures data integrity and compliance with relevant regulations and required reports. Ensures regulatory compliance with applicable federal, state, and local codes and regulations. Ensures HR policies and procedures comply with all legal and regulatory requirements. Operational Management: Maintains a positive and inclusive workplace culture. Works with staff within Operations and Facilities to set performance expectations and goals. Leads through influence and emotional intelligence, fostering a positive and collaborative work environment that values equity and excellence. Develops collaborative relationships through effective communication with staff, faculty, and external stakeholders. Attends professional development programs, workshops, and seminars to remain up-to-date on topics related to facilities management, custodial services, governmental codes, rules and regulations, and other subjects related to campus operations. Other Responsibilities: Understands the mission, role, and function of higher education in general, and of small colleges and health systems owned in particular. Proven ability to work independently of direct supervision and take initiative without specific instructions. Ability to incorporate COHC leadership values and strategies in ensuring objectives and goals are met. Models professional standards, including customer service, collaboration, communication, excellence, and attendance Actively engages in professional development to ensure currency with best practices Travels to all COHC sites as often as required, weekly and/or daily. REQUIRED QUALIFICATIONS: Bachelor’s degree in Education, Healthcare Administration, Business Administration, Finance or a related field required or 3+ years of experience in either Finance, Accounting, or Business Administration. PREFERRED QUALIFICATIONS: Exceptional communication and interpersonal skills, with the ability to foster a collaborative and inclusive work environment. Ability to both effectively lead and participate in collaborative teams. Ability to effectively present information to management, public groups, and/or board of directors. Skilled in the use of personal computers and related office, research, and database software. Experience using technology to support key job requirements (i.e. advanced Microsoft Office Suite - Word, Excel, PowerPoint). Model professional standards, including customer service, collaboration, communication, excellence, and attendance Actively engage in professional development to ensure currency with best practices Capacity to work in a highly collaborative environment with distributed leadership. Ability to develop shared meaning and build consensus across a variety of campuses, programs, and departments. Ability to work effectively in a diverse community and meet the needs of diverse populations. A minimum of 3-5 years of experience related to operations, program and/or facility management. EDUCATION: LICENSES / CERTIFICATIONS: PHYSICAL REQUIREMENTS: S - Sedentary Work - Exerting up to 10 pounds of force occasionally Sedentary work involves sitting most of the time, but may involve walking or standing for brief periods of time. Jobs are sedentary if walking and standing are required only occasionally and all other sedentary criteria are met. For disease specific care programs refer to the program specific requirements of the department for further specifications on experience and educational expectations, including continuing education requirements. Any physical requirements reported by a prospective employee and/or employee’s physician or delegate will be considered for accommodations. PAY RANGE: $70,000.00 - $85,000.00 CITY: Rochester POSTAL CODE: 14622 The listed base pay range is a good faith representation of current potential base pay for a successful full time applicant. It may be modified in the future and eligible for additional pay components. Pay is determined by factors including experience, relevant qualifications, specialty, internal equity, location, and contracts. Rochester Regional Health is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, sex (including pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity or expression, national origin, age, disability, predisposing genetic characteristics, marital or familial status, military or veteran status, citizenship or immigration status, or any other characteristic protected by federal, state, or local law. Rochester Regional Health is an integrated health services organization serving the people of Western New York, the Finger Lakes, St. Lawrence County, and beyond. The system includes nine hospitals; primary and specialty practices, rehabilitation centers, ambulatory campuses and immediate care facilities; innovative senior services, facilities and independent housing; a wide range of behavioral health services; and Rochester Regional Health Laboratories and ACM Global Laboratories, a global leader in patient and clinical trials. It’s vision is to lead the evolution of healthcare to enable every member of the communities it serves to enjoy a better, healthier life.