• Own and strategically lead enterprise-level compliance programs, including SOC 2 Type II, HITRUST, HIPAA, GDPR, ISO 27001, ISO 42001, and ITGC-SOX, from planning through execution and continuous improvement. • Define and mature ISO 27001 and ISO 42001 control environments and SOX 404 ITGCs, including risk assessment, control testing strategy, and remediation oversight. • Serve as the primary point of accountability for audits and certifications, independently managing assessment strategy, scope definition, auditor relationships, executive-level communications, and remediation prioritization. • Design and evolve compliance program frameworks, proactively identifying gaps, scaling controls to support business growth, and aligning compliance initiatives with Spring Health’s risk tolerance and strategic objectives. • Act as a subject matter expert and internal consultant for engineering, product, IT, Legal, Privacy, and Security teams, advising on control design, risk tradeoffs, and audit interpretation. • Lead complex risk assessments and translate technical, regulatory, and operational risk into clear, actionable recommendations for leadership. • Drive maturity of the GRC program and tooling, establishing best practices, improving automation and reporting, and ensuring high-quality, audit-ready evidence across the organization. • Mentor and guide more junior compliance team members, setting standards for quality, rigor, and professionalism across compliance deliverables. • Lead customer assurance and external stakeholder engagements for high-stakes or complex inquiries, including enterprise customer calls, escalations, and detailed security questionnaires. • Own and mature cross-functional programs such as Business Continuity & Disaster Recovery, third-party risk management, and security awareness training, ensuring alignment with industry best practices and regulatory expectations. • Provide strategic insights and regular updates to leadership, including risk trends, audit readiness, compliance metrics, and recommendations for investment or prioritization.