GRC Analyst

You will lead the governance, risk, and compliance program from end to end. You will manage SOC 2 readiness, maintain PHI governance, investigate technical controls using AI coding tools, assess vendor and AI-model risks, drive risk remediation, and respond to customer security requests.

Responsibilities

• Run the SOC 2 compliance program, including auditor management, evidence collection, and continuous audit readiness
• Build and maintain an inventory of PHI data and systems and address HIPAA and governance gaps
• Verify technical controls using AI coding assistants
• Build and run vendor and AI-model security risk reviews
• Prioritize and remediate security risks with engineering
• Author security and compliance policies
• Respond to RFPs and security questionnaires and maintain the trust portal

Requirements

• Senior-level GRC or compliance experience in a SaaS environment
• Experience owning a SOC 2 or equivalent audit through auditor sign-off
• Experience with a GRC automation platform such as Vanta or Drata
• Ability to use AI coding tools to investigate compliance controls
• Vendor threat-modeling skills
• Policy writing and cross-functional communication skills

Benefits

• Comprehensive medical, dental, and vision coverage for employees and dependents
• 401(k) with company match up to 3% of base salary
• Remote-friendly culture and full equipment provisioning
• Parental leave
• Company and team off-sites with travel, lodging, and meals covered
• Flexible time off with no annual cap
• Company-wide holidays and annual holiday shutdown