Security GRC Manager

About the role

The organization operates in the healthcare technology sector, addressing challenges in healthcare navigation and patient care management. Founded in 2017, it provides a mobile platform that integrates clinicians and pharmacists into patients' care journeys, aiming to simplify access to healthcare services and improve treatment outcomes. The organization serves a broad client base and has secured significant investment, indicating growth and expanding impact in healthcare delivery.

The SECURITY GRC MANAGER role is focused on leading and advancing the governance, risk management, and compliance (GRC) functions within the organization. This position is responsible for enhancing risk management programs, managing audit processes including SOC 2 and HITRUST attestations, and overseeing compliance with data privacy and AI governance frameworks. The role significantly contributes to strengthening the organization's security posture and compliance, ensuring trust and assurance for clients and stakeholders.

Responsibilities

• Lead and mentor the GRC team, setting priorities and developing the function.
• Manage and evolve the unified control library aligned with SOC 1, SOC 2, and HITRUST standards.
• Oversee audit programs and coordinate evidence production for internal and external audits.
• Collaborate with Legal on data privacy programs including HIPAA/HITECH compliance and breach management.
• Develop and maintain AI governance programs based on ISO/IEC 42001 and emerging regulations.
• Review and negotiate security and privacy terms in customer and vendor contracts.
• Monitor control effectiveness and maintain continuous compliance monitoring.
• Improve policies and procedures to enhance operational efficiency and security compliance.
• Lead business continuity planning and testing.
• Manage third-party risk with emphasis on data security and technical risk.
• Own the security risk management program including risk assessments and remediation.
• Develop and implement security and compliance training programs.
• Maintain the customer assurance program, including security questionnaire responses and trust center content.

Requirements

• 5-10 years of relevant experience.
• Certification such as CISSP, CISA, or CISM.
• Experience leading SOC 2 with HITRUST CSF certification in a scaling environment.
• Knowledge of AI governance frameworks and AI risk management.
• Leadership experience managing GRC analysts.
• Deep understanding of risk assessment methodologies and HIPAA/HITECH compliance.
• Skilled in negotiating BAAs and conducting breach risk assessments.
• Intermediate to advanced knowledge of SDLC and security tools related to controls.
• Ability to conduct qualitative and quantitative risk assessments.

Pay

$144,000 - $175,000 annually, plus bonus and equity. Compensation varies based on geographic location, experience, and qualifications.