Security GRC Manager

The role

The Security GRC Manager will own and mature the GRC function. This role involves enhancing policies, managing risk, leading the GRC team, and owning SOC 2 and HITRUST attestations.

What you will do

• Lead and mentor a small GRC team
• Own and evolve a unified control library for SOC 2, SOC 1, and HITRUST
• Lead the audit program for control requirements and evidence production
• Partner with Legal on the Data Privacy program including HIPAA/HITECH
• Own and mature the AI governance program
• Review and negotiate security and privacy language in customer and vendor agreements
• Monitor and report on control effectiveness in Drata
• Collaborate to improve policies and procedures
• Lead business continuity planning and testing
• Execute a Third Party Risk Management program

Required qualifications

• 5-10 years of related work experience
• Maintains a certification relevant to the role (e.g, CISSP, CISA, CISM)
• Personally led SOC2 with HITRUST CSF certification in a high growth environment
• Familiarity with AI governance frameworks (e.g., ISO/IEC 42001)
• Experience leading or mentoring GRC analysts
• Deep understanding of risk assessment methodology, HIPAA, and HITECH
• Ability to negotiate and redline BAAs
• Ability to conduct four-factor breach risk assessments
• Intermediate to advanced understanding of the Software Development Life Cycle
• Intermediate to advanced understanding of IT and security tooling (Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, Knowbe4, Drata, AWS, Okta, JIRA, GIT/GITHUB)
• Ability to perform qualitative and quantitative risk assessment

Nice to have

• Experience with joint SOC 2/HITRUST attestations
• A blend of deep, technical and compliance knowledge and experience

About the company

Rightway is on a mission to harmonize healthcare for everyone, everywhere. The company uses a modern, mobile app to guide patients to the best care and medications.