Security GRC Manager

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security GRC Manager based in the United States. Lead and strengthen a growing Governance, Risk, and Compliance (GRC) function in a remote-first environment focused on healthcare technology and data protection. In this role, you will shape security policies, mature enterprise risk management, and oversee integrated SOC 2 and HITRUST compliance programs. You will collaborate with Engineering, IT, Legal, People, and Finance to build practical controls that scale with business needs. You will also lead AI governance initiatives, privacy compliance, third-party risk management, and customer security assurance. Combining technical expertise with strategic leadership, you will help embed security and compliance into everyday operations rather than treating them as check-the-box exercises. This is an opportunity to influence organizational resilience, protect sensitive information, and mentor a growing GRC team. Accountabilities - Lead the GRC function: Manage and mentor a small GRC team, establish priorities, review deliverables, and develop the function in line with organizational growth. - Own compliance frameworks: Maintain and improve a unified control library mapped to SOC 1, SOC 2, and the latest HITRUST CSF requirements, addressing gaps as business needs and standards evolve. - Manage audits and attestations: Lead preparation, evidence collection, and coordination for SOC 1, SOC 2/HITRUST, and customer audits in partnership with Engineering, IT, People, Finance, and other stakeholders. - Oversee privacy and data protection: Partner with Legal on HIPAA/HITECH compliance, business associate agreements (BAAs), privacy and data protection impact assessments, data-handling requirements, and incident or breach risk analysis.

- Develop AI governance: Mature an AI governance program aligned with ISO/IEC 42001 principles, maintaining the AI risk register, Statement of Applicability, and internal AI risk assessments. Respond to customer and partner AI governance questionnaires and monitor emerging requirements, including Colorado's Automated Decision-Making Technology Act. - Review security and privacy contracts: Assess and negotiate customer and vendor contract provisions covering security, privacy, data protection, incident notification, audit rights, and AI-related obligations. - Monitor control effectiveness: Use Drata to track controls, collect evidence continuously, measure compliance performance, and refine implementation strategies as risks and requirements change. - Strengthen policies and procedures: Work with cross-functional teams to improve security policies, streamline workflows, and increase operational efficiency and control maturity. - Lead business continuity planning: Develop and test business continuity plans informed by business impact analysis (BIA) and organizational resilience priorities. - Manage third-party risk: Improve and operate a practical third-party risk management (TPRM) program that evaluates technical and data security risks alongside compliance obligations. - Own security risk management: Coordinate risk identification, qualitative and quantitative assessments, risk-register maintenance, remediation tracking, and annual enterprise risk assessment activities. - Develop training and awareness: Partner with stakeholders to create and deliver effective security and compliance training programs. - Manage customer assurance: Oversee security questionnaires, RFP responses, trust center content, and supporting tools to deliver accurate, timely responses to prospective customers and internal proposal teams. Requirements - Relevant experience: 5–10 years of professional experience in governance, risk, compliance, information security, or a related field.