Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 48 days agoWe saw it 30 min after it went up

Senior Manager, GRC

Maven Clinic30 open roles

Pay
$170,000 – $201,000 a year
Where
New York, New York, United States; New York, NY; Remote, US (Hub cities)
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Manager, GRCMaven Clinic · New York, New York, United States; New York, NY; Remote, US (Hub cities)

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Maven Clinic's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. Maven Clinic postings stay open a median of 49 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 48 days ago

Maven Clinic median: 49 days open

The posting

Maven Clinic is the world's largest virtual clinic for women and families on a mission to make healthcare work for all of us. Through Maven Enterprise, the company partners with more than 2,300 employers and health plans to provide end-to-end women's and family health programs spanning fertility and family building, maternity and newborn care, parenting and pediatrics, and menopause and midlife — improving clinical outcomes, reducing healthcare costs, and expanding equitable access to high-quality care at scale. Through its consumer platform, Maven provides direct access to virtual care across 30+ specialties, as well as dedicated hormone and GLP-1 care programs purpose-built for women. Founded in 2014 by CEO Kate Ryder, Maven Clinic has raised more than $425 million from leading healthcare and technology investors including General Catalyst, Sequoia, Dragoneer Investment Group, Oak HC/FT, StepStone Group, Icon Ventures, and Lux Capital. Recognized for innovation and industry leadership, Maven has been named to the TIME100 Most Influential Companies, CNBC Disruptor 50, Fast Company's Most Innovative Companies, and FORTUNE Best Places to Work. Learn more at mavenclinic.com

An award-winning culture working towards an important mission – Maven Clinic is a recipient of over 30 workplace and innovation awards, including:

  • TIME 100 Most Influential Companies (2023, 2026)
  • Fortune Change the World (2024)
  • CNBC Disruptor 50 List (2022, 2023, 2024)
  • Fortune Best Workplaces for Millennials (2024)
  • Fortune Best Workplaces in Health Care (2024)
  • Fast Company Most Innovative Companies (2020, 2023)
  • Fortune Best Workplaces NY (2020, 2021, 2022, 2023, 2024)

About the Role:

We're looking for a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You'll act as the team lead for our GRC function, working closely with one other team member to run audits, write policies, answer RFIs, and monitor controls day to day.

This role touches almost every team: partnering with Engineering, IT, and HR to gather evidence and close gaps; working directly with customers and their security teams during due diligence; and managing auditor relationships through certification cycles. You'll also bring solid project management skills, sequencing audits, tracking remediation, and hitting deadlines across multiple concurrent workstreams. You'll report directly to the CISO/Head of Security and act as the organization's primary voice on compliance posture. You will interface internally and externally with customers, auditors, and partners.

Our platform facilitates virtual health visits for employer-sponsored benefits, which means security, privacy, and compliance are core to customer trust and our ability to sell into enterprise and health-plan accounts.

What You'll Do:

External Audit & Certification Management

  • Own continuation and renewal of our SOC 2 (Type II) and HITRUST certifications end-to-end. You'll scope each cycle, pull evidence, work directly with auditors, and track remediation through to the final report.
  • Lead the ground-up establishment of ISO 27001 and ISO 42001 certification programs. That means gap assessments, control mapping, writing ISMS/AIMS policies and statements of applicability, gaining cross team buy in, and getting us ready for initial certification audits.
  • Manage the annual/ongoing audit calendar across all frameworks, coordinating with internal stakeholders (Engineering, IT, HR, Legal) to gather evidence and close findings on time.
  • Track regulatory and framework changes (HIPAA, state privacy laws, ISO updates) and translate them into control updates.

Customer-Facing Security & Compliance

  • Serve as the primary owner of security questionnaires and RFIs/RFPs for the Sales and Customer Success teams. Ensure responses to prospect and customer’s due-diligence requests are accurate and on deadline.
  • Maintain a security knowledge base / answer library to reduce turnaround time on recurring questions.
  • Partner with Sales Engineering and Account teams to represent our security and compliance posture directly in customer calls when needed. You'll join customer calls directly when security is a blocker in the deal.
  • Manage relationships with customers' internal security/compliance teams during onboarding and renewal cycles.

Internal Audit & Control Monitoring

  • Build and run an internal audit/control-monitoring program focused first on verifying that externally audited controls are actually operating day-to-day.
  • Flag control gaps or process drift to the CISO/Head of Security before they become audit findings.
  • Over time, expand scope beyond audited-control verification into broader internal audit territory (policy adherence, vendor risk, operational risk) as bandwidth allows.

What You'll Bring:

Required:

  • 6+ years of experience in GRC, information security compliance, or IT audit, with direct ownership of at least one SOC 2 or similar audit cycle from start to finish.
  • Working knowledge of SOC 2, HITRUST, and ISO 27001 frameworks hands-on .
  • Experience responding to customer security questionnaires/RFIs, ideally in a B2B SaaS or healthcare-adjacent environment.
  • Strong cross-team collaboration skills. You'll regularly work with Engineering, IT, HR, Legal, and Sales to gather evidence, close control gaps, and keep everyone aligned on deadlines.
  • Solid project management instincts: able to sequence overlapping audits and certification projects, track dependencies and remediation items, and hit dates without needing someone else to manage the plan for you.
  • Strong written communication; you'll be writing policies, RFI responses, and audit narratives that both auditors and non-technical stakeholders need to understand.

Strongly preferred:

  • Direct experience standing up a new certification (SOC2, HITRUST, ISO 27001 and/or the newer 42001 AI management standard) rather than just maintaining an existing one.
  • Experience with GRC/compliance automation tooling (Vanta, Drata, Secureframe, Hyperproof, or similar).
  • Background in health tech, digital health, or another regulated B2B vertical (fintech, insurtech) where compliance is a sales enabler.
  • A relevant certification such as CISA, CRISC, CISSP, PMP or CAPM, CISM, CTRC/CAP.
  • Exposure to vulnerability management or IT operations well enough to meaningfully audit those processes rather than just take reports at face value.
  • Experience partnering with Sales/Sales Engineering as a technical or compliance resource during the deal cycle.

The base salary range for this role is $170,000 - $201,000 per year. You will also be entitled to receive equity and benefits. Individual pay decisions are based on a number of factors, including qualifications for the role, experience level, and skillset.

Maven embraces a flexible hybrid work model. Our teams primarily operate from the New York Metropolitan area, NY, and remotely via San Francisco/Bay Area, CA, Seattle, WA. For those in our New York City office, we encourage in-person collaboration by requiring team members to work onsite three days a week (Tuesday, Wednesday, Thursday). For those based in Boston, DC, Chicago, Seattle, and San Francisco, we encourage in-person collaboration by requiring team members to attend monthly Work Together Days within these cities. This policy aims to balance remote work flexibility with the benefits of face-to-face interaction.

At Maven we believe that a diverse set of backgrounds and experiences enrich our teams and allow us to achieve above and beyond our goals. If you do not have experience in all of the areas detailed above, we hope that you will share your unique background with us in your application and how it can be additive to our teams.

Benefits That Work For You

Our benefits are designed to support your health, well-being and career development, helping you thrive both personally and professionally. We remain focused on providing a competitive benefits package for our employees. On top of standards such as employer-covered health, dental, and insurance plan options, we offer an inclusive approach to benefits:

  • Maven for Mavens: access to the full platform and specialists, including care for mental health, reproductive health, family planning and pediatrics.
  • Whole-self care through wellness partnerships
  • Hybrid work, in office meals, and work together days
  • 16 weeks 100% paid parental leave and new parent stipend (for Mavens who've been with us for 1 year+)
  • Annual professional development stipend and access to a personal career coach through Maven for Mavens
  • 401K matching for US-based employees, with immediate vesting

These benefits are applicable to Maven Clinic Co., US-based, full-time employees only. 1099/Contract Providers are ineligible for these benefits.

Maven is an affirmative action and equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, disability, age, sexual orientation, gender identity, national origin, veteran status, or genetic information. Maven is committed to providing access, equal opportunity and reasonable accommodation for individuals with disabilities in employment, its services, programs, and activities. Maven Clinic interview requests and job offers only originate from an @mavenclinic.com email address (e.g [email protected]). Maven Clinic will never ask for sensitive information to be delivered over email or phone. If you receive a scam issue or a security issue involving Maven Clinic please notify us at: [email protected]. For general and additional inquiries, please contact us at [email protected].

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Maven Clinic's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Maven Clinic's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Maven Clinic's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.