Senior Manager of Governance, Risk, and Compliance

Join our team as a Senior Manager of Governance, Risk, and Compliance (GRC) for our B2B health benefits platform. In this role, you will lead our GRC function, working closely with various teams to run audits, write policies, and monitor controls. You will report directly to the CISO/Head of Security and act as the organization's primary voice on compliance posture. Your responsibilities will include managing certifications, tracking regulatory changes, and serving as the primary owner of security questionnaires. You will also have the opportunity to build and run an internal audit/control-monitoring program.

• Assumer la responsabilité de la gouvernance, des risques et de la conformité pour la plateforme de prestations de santé B2B, en dirigeant les audits, en rédigeant les politiques et en surveillant les contrôles.
• Gérer la continuation et le renouvellement des certifications SOC 2 (Type II) et HITRUST, en scannant chaque cycle, en tirant des preuves et en travaillant directement avec les auditeurs.
• Établir des programmes de certification ISO 27001 et ISO 42001, en réalisant des évaluations des lacunes, en cartographiant les contrôles et en rédigeant les politiques.

• Experience responding to customer security questionnaires/RFIs, ideally in a B2B SaaS or healthcare-adjacent environment
• Strong cross-team collaboration skills. You'll regularly work with Engineering, IT, HR, Legal, and Sales to gather evidence, close control gaps, and keep everyone aligned on deadlines
• 6+ years of experience in GRC, information security compliance, or IT audit, with direct ownership of at least one SOC 2 or similar audit cycle from start to finish
• Working knowledge of SOC 2, HITRUST, and ISO 27001 frameworks hands-on
• Strong written communication; you'll be writing policies, RFI responses, and audit narratives that both auditors and non-technical stakeholders need to understand
• Solid project management instincts: able to sequence overlapping audits and certification projects, track dependencies and remediation items, and hit dates without needing someone else to manage the plan for you
• Experience with GRC/compliance automation tooling (Vanta, Drata, Secureframe, Hyperproof, or similar)
• Direct experience standing up a new certification (SOC2, HITRUST, ISO 27001 and/or the newer 42001 AI management standard) rather than just maintaining an existing one
• Background in health tech, digital health, or another regulated B2B vertical (fintech, insurtech) where compliance is a sales enabler
• A relevant certification such as CISA, CRISC, CISSP, PMP or CAPM, CISM, CTRC/CAP
• Exposure to vulnerability management or IT operations well enough to meaningfully audit those processes rather than just take reports at face value
• Experience partnering with Sales/Sales Engineering as a technical or compliance resource during the deal cycle