Senior GRC Analyst, Internal Governance (Remote - US only)

Candidates based in New York City follow a hybrid schedule with in-office work Tuesday through Thursday. A fast-growing healthcare company that works with employers to redesign how care is delivered and paid for is hiring a Senior GRC Analyst for its Technical Compliance team. The role owns the recurring risk, vendor, findings and governance work that keeps the security program running effectively between formal audits. The team protects sensitive healthcare data and supports the company's ability to win enterprise customers and scale securely.

What you'll do

• Own the annual information security risk assessment and risk register, covering identification, scoring, treatment and reporting
• Manage risk exceptions and prepare risk acceptance decisions for leadership
• Run third-party and vendor risk reviews from intake through approval and periodic reassessment
• Track security findings from scans, penetration tests, audits, client assessments and incidents to resolution with engineering teams, enforcing SLAs and escalating items that need a risk decision
• Run the security and compliance training program, including annual awareness and HIPAA training, onboarding and completion tracking
• Maintain compliance policies, standards and procedures, and report compliance posture to senior leadership
• Automate GRC workflows with scripting and AI tools, and scope larger automation work for engineering

What you need

• 5+ years in GRC, IT risk management, third-party risk management or information security compliance
• Experience running information security risk assessments and maintaining a risk register using frameworks such as NIST CSF or ISO 27005
• Hands-on experience with vendor risk management and findings remediation in a cloud-native engineering environment
• Working knowledge of HIPAA, SOC 2, ISO 27001 and HITRUST requirements
• Ability to drive accountability across teams you do not manage and adapt communication across engineers, operators and executives
• Prior experience using scripting and LLM tools to automate repetitive work is strongly preferred
• Must be authorized to work in the United States; visa sponsorship is not available
• Certifications such as CISA, CISM, CISSP, CRISC or ISO 27001 Lead Auditor are a plus

Applicants must be based in: United States.

How to apply

Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.

Prefer the website? Continue on illtip.comOr get the app: Android · iPhone

🔔 Get new jobs like this first: join i'llTip Jobs on Telegram · or get personal job alerts