Senior Compliance Specialist II

What you’ll do:

• Serve as a primary compliance resource embedded in the Alma-to-Spring Health integration effort, building a working understanding of Alma's GRC architecture, tooling, vendor relationships, and audit history.
• Map Alma's existing control environment against Spring Health's compliance frameworks, identifying gaps, redundancies, and opportunities for harmonization.
• Partner with engineering, IT, security, and legal stakeholders across both organizations to facilitate a structured transition of compliance obligations, evidence, and tooling into a unified program.
• Communicate integration status, risk findings, and program recommendations clearly to senior compliance leadership throughout the transition.
• Own and strategically lead enterprise-level compliance programs, including SOC 2 Type II, HITRUST, HIPAA, GDPR, ISO 27001, ISO 42001, and ITGC-SOX, from planning through execution and continuous improvement.
• Lead complex risk assessments and translate technical, regulatory, and operational risk into clear, actionable recommendations for leadership.
• Provide strategic insights and regular updates to leadership, including risk trends, audit readiness, compliance metrics, and recommendations for investment or prioritization.
• Lead the development and operationalization of Spring Health's AI governance program, establishing policies, risk frameworks, and control standards that address the unique compliance and ethical considerations of AI and ML systems.
• Build and maintain AI-specific compliance documentation including AI use registers, model risk assessments, and governance procedures aligned to regulatory expectations.
• Monitor the evolving global AI regulatory landscape (EU AI Act, NIST AI RMF, and others) and proactively advise leadership on impact to Spring Health's operations and product roadmap.
• Conduct compliance vendor reviews with a particular focus on AI vendors, assessing data handling practices, model governance, regulatory alignment, and contractual compliance obligations.
• Drive maturity of the GRC program and tooling, establishing best practices, improving automation and reporting, and ensuring high-quality, audit-ready evidence across the organization.
• Integrate AI into team workflows in a structured way, such as building AI-assisted playbooks for evidence review, audit prep, and risk assessment documentation.
• Evaluate new AI tools and techniques relevant to compliance and GRC work; share learnings with the team and model disciplined adoption.
• Establish quality standards for AI-assisted compliance work across the team, ensuring outputs meet the rigor and auditability expected of regulated deliverables.
• Mentor and guide more junior compliance team members, setting standards for quality, rigor, and professionalism across compliance deliverables.
• Lead customer assurance and external stakeholder engagements for high-stakes or complex inquiries, including enterprise customer calls, escalations, and detailed security questionnaires.

  What you’ll bring:

  • Bachelor’s degree plus 7+ years of progressive experience in a GRC, IT compliance, security, risk, or related fields.
  • Experience building or contributing to an AI governance program, including familiarity with AI risk frameworks, model risk assessment, and translating AI-related regulatory requirements into operational controls.
  • Strong technical foundation for mapping complex product architecture to compliance requirements, including certifications and customer obligations, and driving independent stakeholder discussions.
  • Deep, hands-on expertise with frameworks and regulations such as SOC 2, HITRUST, HIPAA, GDPR, ISO 27001, ISO 42001, and SOX ITGCs.
  • Proven experience leading large-scale audits and certification efforts end-to-end with minimal oversight.
  • Strong ability to interpret regulatory requirements and translate them into pragmatic, scalable controls.
  • Demonstrated track record of influencing cross-functional stakeholders and driving outcomes without formal authority.
  • Exceptional written and verbal communication skills, with the ability to engage effectively with both technical teams and executive leadership.
  • Highly organized, proactive, and comfortable operating in ambiguity within a fast-paced environment.