Security GRC Manager

Lead and strengthen a growing Governance, Risk, and Compliance (GRC) function in a remote-first environment focused on healthcare technology and data protection. In this role, you will shape security policies, mature enterprise risk management, and oversee integrated SOC 2 and HITRUST compliance programs. You will collaborate with Engineering, IT, Legal, People, and Finance to build practical controls that scale with business needs. You will also lead AI governance initiatives, privacy compliance, third-party risk management, and customer security assurance. Combining technical expertise with strategic leadership, you will help embed security and compliance into everyday operations rather than treating them as check-the-box exercises. This is an opportunity to influence organizational resilience, protect sensitive information, and mentor a growing GRC team.

• Relevant experience: 5–10 years of professional experience in governance, risk, compliance, information security, or a related field.

• Professional certification: An active, relevant certification such as CISSP, CISA, or CISM.

• Compliance leadership: Direct experience leading SOC 2 and HITRUST CSF certification or attestation efforts in a high-growth environment, with the ability to scale controls to organizational maturity and available resources.

• AI governance knowledge: Familiarity with AI governance frameworks such as ISO/IEC 42001 and the risks associated with AI systems that process sensitive information.

• Team management: Experience leading or mentoring GRC analysts, setting priorities, reviewing work, and building an effective compliance function.

• Healthcare privacy expertise: Strong understanding of risk assessment methodologies, HIPAA, and HITECH, including the distinction between covered entity and business associate responsibilities.

• Breach assessment and contract expertise: Comfortable negotiating and redlining BAAs and conducting four-factor breach risk assessments in collaboration with Privacy and Legal teams.

• Technical security knowledge: Intermediate to advanced understanding of the software development lifecycle (SDLC), IT environments, security controls, and relevant tools and platforms.

• Security tooling familiarity: Experience with tools such as Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, KnowBe4, and Drata, as well as environments involving AWS, Okta, Jira, and Git/GitHub.

• Risk assessment capabilities: Ability to conduct both qualitative and quantitative risk assessments and translate findings into practical mitigation strategies.

• Strategic mindset: A strong commitment to using governance, risk, and compliance as tools for improving security, protecting sensitive data, and strengthening organizational resilience.

• Additional advantage: Experience with integrated SOC 2/HITRUST attestations or a combination of deep technical security knowledge and compliance expertise.