Manager and Senior Manager: Governance, Risk, & Compliance (GRC)

RESPONSIBILITIES

Drive the development, implementation, and continuous evolution of the governance program, driving both strategy and hands-on execution to maintain alignment with ISO 27001, SOC 2, GDPR, and other applicable regulatory frameworks

Partner in the development, implementation, and ongoing management of scalable security control frameworks, policies, standards, and security awareness programs, third-party risk assessment, SDLC assessment, and risk program management, contributing directly while guiding the team’s work to strengthen organizational compliance

Support incident response activities by ensuring regulatory requirements, breach documentation, and post-incident reviews are completed and translated into actionable improvements across the risk and compliance program

Actively manage the enterprise risk register, driving risk prioritization, maintaining visibility across key risk domains, and delivering executive-level reporting

Spearhead enterprise risk reviews by driving GRC intake and request triage, personally overseeing complex assessments while prioritizing and delegating work across the team

Coach, mentor, and develop GRC analysts while balancing hands-on execution with effective delegation and team enablement as the program scales

Lead the third-party risk management lifecycle by conducting and overseeing vendor risk assessments and due diligence in partnership with Legal, IT, and Security

Own the operational intake and triage process for all GRC requests, including third-party vendor risk assessments, security questionnaires, SDLC risk reviews, and compliance inquiries, ensuring work is prioritized, assigned, and completed within established service levels 

Develop and report operational metrics and KPIs, providing weekly dashboards and status updates on assessment volumes, turnaround times, backlog, SLA performance, and program health to the leadership 

Evaluate, implement, and continuously improve GRC tools, processes, and metrics through hands-on execution and operational leadership to support program scale, transparency, and accountability

QUALIFICATIONS

8+ years of experience in GRC, or information security preferably in health tech, SaaS, or regulated environments, with ~4+ years managing GRC, compliance, audit or cybersecurity professionals

Deep understanding of regulations and standards including, but not limited to ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations applicable to regulated or sensitive health data, including HIPAA where relevant

Experience managing or mentoring compliance, audit, or GRC professionals

Demonstrated experience leading operational GRC programs, including workload prioritization, KPI reporting, and cross-functional coordination

Strong understanding of cybersecurity controls, cloud security concepts, third-party risk assurance, and regulatory compliance requirements 

Proven ability to build scalable, process-driven programs in high-growth or rapidly evolving environments

Highly organized and detail-oriented, with strong project execution and prioritization skills across competing deadlines

Superior communication and interpersonal skills - written and verbal

Relevant certifications (CISA, CISSP, CRISC, CIPP/E, ISO Lead Auditor, HITRUST CCSFP, or similar) are strongly preferred 

A minimum bachelor’s degree in any discipline. Computer science, cyber security and risk or technology degrees preferred.