Director, IT Compliance

Position Summary:

The Director, IT Compliance will play a critical role in maintaining the integrity, confidentiality, and availability of an organization’s IT systems, processes, and data while ensuring compliance with applicable laws and regulations. Reporting to the Information Security Officer, the Director will be responsible for enterprise IT compliance program execution, SOX ITGC oversight, HIPAA/HITECH compliance, SOC 2 readiness, audit lifecycle management, policy development, risk management, and control framework governance.

Essential Functions and Job Responsibilities:

• Develop and implement strategies to ensure IT systems align with regulatory requirements, industry standards, and best practices. Provide strategic direction to the IT compliance team to achieve organizational objectives effectively.
• Oversee compliance with applicable regulations including SOX, HIPAA/HITECH, and other industry-specific standards. Stay abreast of regulatory changes and assess their impact on IT operations, initiating necessary adjustments to maintain compliance.
• Partner with Internal Audit, Finance, Legal, and external auditors to support IT compliance program objectives, audit readiness, and regulatory reporting requirements.
• Develop, review, and enforce IT policies, procedures, and standards to mitigate risks and ensure compliance with regulatory requirements. Collaborate with legal and other departments to ensure alignment with corporate governance objectives.
• Conduct risk assessments to identify potential vulnerabilities and gaps in IT compliance. Develop and implement mitigation strategies to address identified risks and ensure the integrity and security of IT systems and data.
• Manage the end-to-end IT audit lifecycle, including SOX ITGC and SOC 2 Type II cycles. Coordinate audit activities, oversee evidence quality review and upload into audit management platforms, serve as primary liaison to internal audit and external auditors, and drive timely remediation of findings.
• Develop and deliver training programs to increase awareness of IT compliance requirements across the organization. Foster a culture of compliance by educating employees on their roles and responsibilities in maintaining IT security and regulatory adherence.
• Evaluate and monitor the compliance of vendors and third-party service providers with contractual and regulatory requirements. Establish processes for vendor risk management and ensure compliance throughout the vendor lifecycle.
• Develop and implement incident response procedures to address IT compliance breaches promptly. Lead investigations into compliance incidents, identify root causes, and implement corrective actions to prevent recurrence.
• Maintain and update the SOX IT scope inventory; coordinate with control owners across IT and business functions to ensure accurate, timely population delivery, evidence quality, and understanding of ITGC requirements.
• Support SOC 2 Type II readiness and ongoing certification activities, including coordination with external auditors and management of Trust Services Criteria control evidence.
• Administer and optimize GRC platform tooling; maintain the enterprise control library and support unified mapping across NIST, SOX ITGCs, HIPAA Security Rule, and SOC 2 TSC.
• Evaluate new technologies and IT systems to ensure compliance with regulatory requirements and organizational policies. Collaborate with IT teams to integrate compliance considerations into the technology selection and implementation process.
• Prepare regular reports and presentations for executive management and board of directors on IT compliance activities, status, and issues. Communicate effectively with stakeholders to foster transparency and support decision-making processes.
• Maintain patient confidentiality and function within the guidelines of HIPAA.
• Completes assigned compliance training and other educational programs as required.
• Maintains compliant with AdaptHealth's Compliance Program.
• Performs other related duties as assigned.

Management / Supervision:  

• Responsible for selection and hiring of qualified staff, ensuring an effective on-boarding, and providing comprehensive training and regular feedback.
• Leads the GRC/Compliance function within Information Security, including direct management of GRC analysts and compliance staff; coordinates with the Cybersecurity function to ensure alignment across the Information Security program.
• Accomplishes staff results by communicating job expectations; planning, monitoring, and appraising job results; coaching, counseling, and disciplining employees; developing, coordinating, and enforcing systems, policies, procedures, and productivity standards.
• Establishes annual goals and objectives for the department based on the organization's strategic goals.
• Responsible for achieving organizational performance and retention goals, including timely completion of performance evaluations.

Competency, Skills, and Abilities:

• Deep understanding of regulatory requirements and control frameworks including SOX ITGCs, HIPAA/HITECH, NIST CSF 2.0, SOC 2 TSC, and PCI-DSS; experience mapping controls across multiple frameworks to reduce duplication and support unified compliance programs.
• Strong leadership skills with the ability to drive cross-functional teams and influence stakeholders at all levels of the organization.
• Excellent communication and presentation skills, with the ability to translate complex technical concepts into clear and actionable recommendations.
• Strategic thinking and problem-solving abilities, with a focus on continuous improvement and innovation.
• Experience with IT audit processes, risk management frameworks, and incident response procedures.
• Demonstrated critical thinking and knowledge of data analysis tools and techniques and decision-making abilities.
• Demonstrated experience in highly dynamic environment undergoing change; ability to deal with competing priorities.
• Ability to analyze and modify processes in a complex and growing environment.
• Detail-oriented, process-oriented, control-oriented.
• Exceptional communication skills, ability to manage expectations of management and team.
• Excellent analytical skills, the ability to manage multiple projects under strict timelines, and the ability to meet overall objectives while working well in a demanding, dynamic environment.
• Project management skills including financial/budget management, scheduling, and resource management.
• Ability to manage multiple priorities in a fast-paced environment while maintaining attention to detail and accuracy.
• Ability to lead and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals.

Education and Experience Requirements:

• Bachelor's degree in Information Technology, Computer Science, Business Administration, or related field. Advanced degree or professional certification (e.g., CISA, CISSP, CRISC) preferred.
• Proven experience (8+ years) in IT compliance management, preferably in a public company or regulated industry environment. Experience at Big4 public accounting firm highly desired.
• 3 years of direct team lead or management experience leading and directing work with both internal and external partners in a highly collaborative environment.

Physical Demands and Work Environment:

• Work environment will be stressful at times, as overall office activities and work levels fluctuate.
• Must be able to bend, stoop, stretch, stand, and sit for extended periods of time.
• Subject to long periods of sitting and exposure to computer screen.
• Ability to perform repetitive motions of wrists, hands, and/or fingers due to extensive computer use.
• Metal ability to lead others and change processes in a fast-paced work environment.
• Must be able to lift 30 pounds as needed.
• Excellent ability to communicate both verbally and in writing.
• May be exposed to angry or irate customers. 
• Must be able to travel as needed.
• Ability to effectively communicate both verbally and written with internal and external customers with the ability to demonstrate empathy, compassion, courtesy, and respect for privacy.
• Physical and mental ability to analyze data, problem solving and critical thinking.