Security GRC Manager

This is a fully remote position, open to applicants in Florida.

📋 Description

• Lead and mentor a small Governance, Risk, and Compliance (GRC) team, establishing priorities, reviewing outputs, and developing the function.

• Own and enhance the unified control library, ensuring mappings across SOC 2, SOC 1, and the latest version of HITRUST.

• Direct the audit program for control requirements and evidence generation in collaboration with Engineering, IT, People, and Finance departments.

• Collaborate with Legal on data privacy initiatives, including HIPAA/HITECH, Business Associate Agreements (BAAs), privacy and protection impact assessments, incident/breach analysis, and data handling obligations.

• Oversee and advance the AI governance program based on ISO/IEC 42001, which includes the AI risk register, Statement of Applicability, and AI risk evaluations.

• Address customer and partner inquiries regarding AI governance and ensure compliance with evolving regulations such as the Colorado ADMTA.

• Review and negotiate security, privacy, data protection, incident notification, audit rights, AI, and related clauses in agreements with customers and vendors.

• Monitor, evaluate, and report on control effectiveness in Drata, ensuring continuous control monitoring and evidence gathering.

• Enhance policies and procedures to boost operational efficiency, control maturity, security, and compliance.

• Lead the business continuity planning and testing efforts, focusing on a program informed by Business Impact Analysis (BIA).

• Revise and implement the Third Party Risk Management program.

• Manage the security risk management program, which includes enterprise risk preparation, discussions, tracking, remediation, and annual risk assessments.

• Create and implement security and compliance training initiatives.

• Oversee and maintain the customer assurance program, which includes security questionnaires, RFP responses, trust center content, and supporting tools.

⛳️ Requirements

• 5-10 years of relevant work experience.

• Holds a certification pertinent to the role (e.g., CISSP, CISA, CISM).

• Has personally led SOC 2 with HITRUST CSF certification in a rapidly growing environment and understands how to enhance controls in line with organizational maturity and capacity.

• Knowledge of AI governance frameworks (e.g., ISO/IEC 42001) and the risk factors associated with AI systems that handle sensitive data.

• Experience in leading or mentoring GRC analysts.

• Comprehensive understanding of risk assessment methodologies, HIPAA, and HITECH, including the practical differences between covered entity and business associate responsibilities.

• Proficient in negotiating and revising BAAs and conducting four-factor breach risk assessments in collaboration with Privacy and Legal teams.

• Intermediate to advanced knowledge of the Software Development Life Cycle and IT/security tools (Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, Knowbe4, Drata, AWS, Okta, JIRA, GIT/GITHUB) as they relate to controls.

• Capability to conduct qualitative and quantitative risk assessments.

• Experience with joint SOC 2/HITRUST attestations (preferred).

• A combination of in-depth technical and compliance expertise (preferred).

🏝️ Benefits

• Bonus.

• Equity.

• Equal Opportunity Employer with an inclusive culture where diversity is celebrated.