Manager and Senior Manager: Governance, Risk, & Compliance

Responsibilities

• Drive the development, implementation, and continuous evolution of the governance program, driving both strategy and hands-on execution to maintain alignment with ISO 27001, SOC 2, GDPR, and other applicable regulatory frameworks.
• Partner in the development, implementation, and ongoing management of scalable security control frameworks, policies, standards, and security awareness programs, third-party risk assessment, SDLC assessment, and risk program management, contributing directly while guiding the team’s work to strengthen organizational compliance.
• Support incident response activities by ensuring regulatory requirements, breach documentation, and post-incident reviews are completed and translated into actionable improvements across the risk and compliance program.
• Actively manage the enterprise risk register, driving risk prioritization, maintaining visibility across key risk domains, and delivering executive-level reporting.
• Spearhead enterprise risk reviews by driving GRC intake and request triage, personally overseeing complex assessments while prioritizing and delegating work across the team.
• Coach, mentor, and develop GRC analysts while balancing hands-on execution with effective delegation and team enablement as the program scales.
• Lead the third-party risk management lifecycle by conducting and overseeing vendor risk assessments and due diligence in partnership with Legal, IT, and Security.
• Own the operational intake and triage process for all GRC requests, including third-party vendor risk assessments, security questionnaires, SDLC risk reviews, and compliance inquiries, ensuring work is prioritized, assigned, and completed within established service levels.
• Develop and report operational metrics and KPIs, providing weekly dashboards and status updates on assessment volumes, turnaround times, backlog, SLA performance, and program health to the leadership.
• Evaluate, implement, and continuously improve GRC tools, processes, and metrics through hands-on execution and operational leadership to support program scale, transparency, and accountability.

Qualifications

• 8+ years of experience in GRC, or information security preferably in health tech, SaaS, or regulated environments, with ~4+ years managing GRC, compliance, audit or cybersecurity professionals.
• Deep understanding of regulations and standards including, but not limited to ISO 27001, SOC 2, GDPR, PCI, NIST CSF, and privacy/security obligations applicable to regulated or sensitive health data, including HIPAA where relevant.
• Experience managing or mentoring compliance, audit, or GRC professionals.
• Demonstrated experience leading operational GRC programs, including workload prioritization, KPI reporting, and cross-functional coordination.
• Strong understanding of cybersecurity controls, cloud security concepts, third-party risk assurance, and regulatory compliance requirements.
• Proven ability to build scalable, process-driven programs in high-growth or rapidly evolving environments.
• Highly organized and detail-oriented, with strong project execution and prioritization skills across competing deadlines.
• Superior communication and interpersonal skills - written and verbal.
• Relevant certifications (CISA, CISSP, CRISC, CIPP/E, ISO Lead Auditor, HITRUST CCSFP, or similar) are strongly preferred.
• A minimum bachelor’s degree in any discipline. Computer science, cyber security and risk or technology degrees preferred.