Security GRC Manager
New
J
JobgetherHealthcare technology
Based in the United StatesFull-TimeManager
SalaryAnnual base salary: $144,000–$175,000. Eligible for bonus compensation and equity in addition to base salary.
Apply NowOpens the employer's application page
Job Details
- Experience
- 5–10 years of professional experience in governance, risk, compliance, information security, or a related field.
- Required Skills
- AWSHIPAA
Requirements
- Have 5–10 years of professional experience in governance, risk, compliance, information security, or a related field.
- Hold an active, relevant certification such as CISSP, CISA, or CISM.
- Have direct experience leading SOC 2 and HITRUST CSF certification or attestation efforts in a high-growth environment.
- Be familiar with AI governance frameworks such as ISO/IEC 42001 and risks associated with AI systems processing sensitive information.
- Have experience leading or mentoring GRC analysts, setting priorities, reviewing work, and building a compliance function.
- Have a strong understanding of risk assessment methodologies, HIPAA, and HITECH, including covered entity and business associate responsibilities.
- Be comfortable negotiating and redlining BAAs and conducting four-factor breach risk assessments with Privacy and Legal teams.
- Have intermediate to advanced understanding of SDLC, IT environments, security controls, and relevant tools and platforms.
- Have experience with security tools such as Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, KnowBe4, and Drata.
- Have experience with environments involving AWS, Okta, Jira, and Git/GitHub.
- Be able to conduct qualitative and quantitative risk assessments and translate findings into practical mitigation strategies.
Responsibilities
- Manage and mentor a small GRC team, set priorities, review deliverables, and develop the function.
- Maintain and improve a unified control library mapped to SOC 1, SOC 2, and HITRUST CSF requirements.
- Lead preparation, evidence collection, and coordination for SOC 1, SOC 2/HITRUST, and customer audits.
- Partner with Legal on HIPAA/HITECH compliance, BAAs, privacy assessments, data-handling requirements, and breach risk analysis.
- Develop the AI governance program, maintain its risk register and Statement of Applicability, and conduct internal AI risk assessments.
- Assess and negotiate customer and vendor contract provisions covering security, privacy, data protection, incident notification, audit rights, and AI obligations.
- Use Drata to track controls, collect evidence, measure compliance performance, and refine implementation strategies.
- Develop and test business continuity plans informed by business impact analysis.
- Operate the third-party risk management program and coordinate enterprise risk assessments, risk-register maintenance, remediation tracking, and risk assessments.
- Oversee security questionnaires, RFP responses, trust center content, and security and compliance training.
View Full Description & ApplyYou'll be redirected to the employer's site
