Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 6 hours agoWe saw it 12 min after it went up

Security GRC Manager

Jobgether3,976 open roles

Where
US
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity GRC ManagerJobgether · US

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Jobgether's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

8.5% of postings close within 7 days. Measured by our own scanner across the market. Jobgether postings stay open a median of 6 days.

Share of postings closed within
  1. 1.8%1 day
  2. 4.0%3 days
  3. 8.5%7 days
  4. 15.4%14 days
  5. 34.1%30 days
This job: posted 6 hours ago

Jobgether median: 6 days open

The posting

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security GRC Manager based in the United States.

Lead and strengthen a growing Governance, Risk, and Compliance (GRC) function in a remote-first environment focused on healthcare technology and data protection. In this role, you will shape security policies, mature enterprise risk management, and oversee integrated SOC 2 and HITRUST compliance programs. You will collaborate with Engineering, IT, Legal, People, and Finance to build practical controls that scale with business needs. You will also lead AI governance initiatives, privacy compliance, third-party risk management, and customer security assurance. Combining technical expertise with strategic leadership, you will help embed security and compliance into everyday operations rather than treating them as check-the-box exercises. This is an opportunity to influence organizational resilience, protect sensitive information, and mentor a growing GRC team.

Accountabilities

  • Lead the GRC function: Manage and mentor a small GRC team, establish priorities, review deliverables, and develop the function in line with organizational growth.
  • Own compliance frameworks: Maintain and improve a unified control library mapped to SOC 1, SOC 2, and the latest HITRUST CSF requirements, addressing gaps as business needs and standards evolve.
  • Manage audits and attestations: Lead preparation, evidence collection, and coordination for SOC 1, SOC 2/HITRUST, and customer audits in partnership with Engineering, IT, People, Finance, and other stakeholders.
  • Oversee privacy and data protection: Partner with Legal on HIPAA/HITECH compliance, business associate agreements (BAAs), privacy and data protection impact assessments, data-handling requirements, and incident or breach risk analysis.
  • Develop AI governance: Mature an AI governance program aligned with ISO/IEC 42001 principles, maintaining the AI risk register, Statement of Applicability, and internal AI risk assessments. Respond to customer and partner AI governance questionnaires and monitor emerging requirements, including Colorado's Automated Decision-Making Technology Act.
  • Review security and privacy contracts: Assess and negotiate customer and vendor contract provisions covering security, privacy, data protection, incident notification, audit rights, and AI-related obligations.
  • Monitor control effectiveness: Use Drata to track controls, collect evidence continuously, measure compliance performance, and refine implementation strategies as risks and requirements change.
  • Strengthen policies and procedures: Work with cross-functional teams to improve security policies, streamline workflows, and increase operational efficiency and control maturity.
  • Lead business continuity planning: Develop and test business continuity plans informed by business impact analysis (BIA) and organizational resilience priorities.
  • Manage third-party risk: Improve and operate a practical third-party risk management (TPRM) program that evaluates technical and data security risks alongside compliance obligations.
  • Own security risk management: Coordinate risk identification, qualitative and quantitative assessments, risk-register maintenance, remediation tracking, and annual enterprise risk assessment activities.
  • Develop training and awareness: Partner with stakeholders to create and deliver effective security and compliance training programs.
  • Manage customer assurance: Oversee security questionnaires, RFP responses, trust center content, and supporting tools to deliver accurate, timely responses to prospective customers and internal proposal teams.
  • Relevant experience: 5–10 years of professional experience in governance, risk, compliance, information security, or a related field.
  • Professional certification: An active, relevant certification such as CISSP, CISA, or CISM.
  • Compliance leadership: Direct experience leading SOC 2 and HITRUST CSF certification or attestation efforts in a high-growth environment, with the ability to scale controls to organizational maturity and available resources.
  • AI governance knowledge: Familiarity with AI governance frameworks such as ISO/IEC 42001 and the risks associated with AI systems that process sensitive information.
  • Team management: Experience leading or mentoring GRC analysts, setting priorities, reviewing work, and building an effective compliance function.
  • Healthcare privacy expertise: Strong understanding of risk assessment methodologies, HIPAA, and HITECH, including the distinction between covered entity and business associate responsibilities.
  • Breach assessment and contract expertise: Comfortable negotiating and redlining BAAs and conducting four-factor breach risk assessments in collaboration with Privacy and Legal teams.
  • Technical security knowledge: Intermediate to advanced understanding of the software development lifecycle (SDLC), IT environments, security controls, and relevant tools and platforms.
  • Security tooling familiarity: Experience with tools such as Jamf, CrowdStrike, Arctic Wolf, Wiz, Serval, KnowBe4, and Drata, as well as environments involving AWS, Okta, Jira, and Git/GitHub.
  • Risk assessment capabilities: Ability to conduct both qualitative and quantitative risk assessments and translate findings into practical mitigation strategies.
  • Strategic mindset: A strong commitment to using governance, risk, and compliance as tools for improving security, protecting sensitive data, and strengthening organizational resilience.
  • Additional advantage: Experience with integrated SOC 2/HITRUST attestations or a combination of deep technical security knowledge and compliance expertise.
  • Annual base salary: $144,000–$175,000.
  • Additional compensation: Eligible for bonus compensation and equity in addition to base salary.
  • Remote work: Remote position with location-based compensation considerations.
  • Compensation flexibility: Final compensation is determined by geographic location, experience, and qualifications.
  • Other benefits: Specific healthcare coverage, retirement plans, paid time off, and additional perks were not detailed in the provided job listing.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Jobgether's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Jobgether's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Jobgether's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.