Senior GRC Analyst, HIPAA
Core
Subject matter expert for HIPAA security compliance, translating legal requirements into operational controls and ensuring regulated data environments are secure and compliant.
Role type
Senior individual contributor GRC analyst
Builds
Scalable HIPAA security controls, compliance documentation, and audit-ready evidence for DoorDash's marketplace platform.
Domain
Healthcare data security, regulatory compliance, cloud infrastructure
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
HIPAA Security Rule expertise, risk assessment, control mapping, gap analysis, audit support, stakeholder management, technical fluency in cloud architecture, IAM, encryption, logging, vulnerability management, secure SDLC
Preferred skills
HITRUST certification experience, SOC 2/ISO 27001 audit experience, third-party risk management, privacy incident response, AI/data platform familiarity
Technologies
Cloud environments, SaaS, IAM, CI/CD, infrastructure-as-code, logging tools, vulnerability scanners
Responsibilities
Lead HIPAA security compliance workstreams across multiple products; perform readiness assessments, gap analyses, and risk assessments; build and maintain control mappings across HIPAA, HITRUST, SOC 2, ISO 27001, and NIST 800-53; partner with Engineering to implement scalable controls for IAM, encryption, and monitoring; maintain security program documentation including policies, procedures, and risk registers; support internal and external audits and compliance evidence collection; partner on incidents involving PHI/ePHI; mature GRC tooling and workflows for continuous control monitoring.
Seniority
Senior, hands-on IC
