Senior GRC Analyst – Internal Governance

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of Garner’s yearly information security risk assessment and maintain the risk register, which includes risk identification, scoring, treatment, and reporting.

• Oversee risk exceptions and prepare risk acceptances for leadership's decision-making.

• Conduct third-party and vendor risk evaluations from initiation through approval and periodic reassessment.

• Manage security findings from vulnerability scans, penetration tests, audits, client assessments, and incidents.

• Monitor remediation efforts with the Engineering team, enforce service level agreements (SLAs), and escalate findings that require risk decisions.

• Lead the security and compliance training program, covering annual security awareness and HIPAA training, onboarding, content updates, and tracking completion.

• Maintain policies, standards, and procedures for compliance.

• Communicate compliance status to senior leadership.

• Enhance the Governance, Risk, and Compliance (GRC) function through AI and automation, identifying quick wins and defining requirements for Engineering.

⛳️ Requirements

• Over 5 years of experience in Governance, Risk, and Compliance (GRC), IT risk management, third-party risk management, or information security compliance.

• Proven experience in conducting information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005.

• Practical experience in vendor risk management and remediation programs for vulnerabilities or findings in a cloud-native engineering environment.

• Solid understanding of HIPAA, SOC 2, ISO 27001, and HITRUST requirements.

• Demonstrated ability to drive accountability across teams without direct management authority.

• Skilled in adapting communication styles for engineers, operators, and executives.

• Previous experience utilizing scripting and LLMs to automate repetitive tasks.

• Preferred industry certifications include CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor.

• Must not require employer sponsorship or takeover of sponsorship for an employment visa.

🏝️ Benefits

• Equity incentive plan.

• Flexible PTO.

• Options for Medical/Dental/Vision plans.

• 401(k) with company matching.

• Flexible spending accounts.

• Teladoc Health services.

• Accommodations for qualified individuals with disabilities during the recruitment process.