Senior GRC Analyst

Join Health Systems Trust as a Senior GRC Analyst, where you will own our governance, risk, and compliance program from end to end. This senior individual contributor role offers the opportunity to shape the program and work with sensitive data. You will be responsible for running SOC 2, maintaining PHI governance, investigating controls, standing up vendor and AI-model risk reviews, driving risk to closure, and serving as the front door for customer trust. The ideal candidate will have senior-level GRC or compliance experience in a SaaS environment, technical curiosity, broader framework experience, and a regulated-industry background.

• Assumer la responsabilité de l'ensemble du programme de gouvernance, de gestion des risques et de conformité (GRC), y compris la gestion de l'audit SOC 2 et la gouvernance des PHI.
• Construire et maintenir un inventaire autoritaire des emplacements des PHI et des systèmes qui les touchent, et identifier et combler les lacunes en matière de conformité HIPAA.
• Établir et gérer le processus de révision de la sécurité pour les nouveaux fournisseurs et les fournisseurs de modèles d'IA, en collaborant avec les équipes juridiques et financières.

• Startup ownership mindset: You thrive in ambiguity, take a partially built function and make it accountable without waiting for structure to be handed to you, and happily work outside a narrow swim lane
• Clear writing and communication: You write policies and standards that hold up to audit and that engineers can actually use, and you work directly and confidently with engineering, legal, and customers
• Hands-on SOC 2 ownership: Senior-level GRC or compliance experience in a SaaS environment, including owning a SOC 2 (or equivalent) audit from evidence collection through auditor sign-off, ideally using a GRC automation platform like Vanta or Drata
• Technical curiosity: Comfortable using an AI coding tool like Claude Code to answer compliance questions directly from source code (you won’t need to write code yourself), and able to threat-model a new vendor: what data it touches, where that data flows, and what controls it needs
• Broader framework experience: ISO 27001 experience, and exposure to ISO 42001 or other AI governance frameworks
• Regulated-industry background: Experience in healthcare, fintech, or another highly regulated industry