Security GRC Manager
Core
Own and mature the GRC function, leading audits, risk management, and compliance programs for a healthcare technology company.
Role type
Senior GRC Manager (Security & Compliance)
Builds
SOC 2, HITRUST, and HIPAA compliance attestations; AI governance frameworks; unified control library.
Domain
Healthcare technology / Cybersecurity / Regulatory Compliance
Required skills
GRC team leadership, SOC 2/HITRUST audit ownership, AI governance (ISO/IEC 42001), HIPAA/HITECH compliance, contract security review, third-party risk management, business continuity planning, quantitative risk assessment.
Preferred skills
Joint SOC 2/HITRUST attestation experience, deep technical and compliance knowledge.
Technologies
Drata, AWS, Okta, JIRA, GIT/GITHUB, Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, Knowbe4.
Responsibilities
Lead and mentor a small GRC team; own the unified control library and mappings; lead audit programs for SOC 1, SOC 2, and HITRUST; partner on Data Privacy and HIPAA/HITECH programs; own the AI governance program; review and negotiate security/privacy clauses in contracts; monitor control effectiveness in Drata; lead business continuity planning; revamp Third Party Risk Management; own the security risk management program; develop security training programs; maintain the customer assurance program.
Seniority
Senior, hands-on IC