Governance Risk & Compliance Analyst

Dosespot; Boston (MA); Remote; USD 115,000 - 155,000; Full time

Job summary

Join a dynamic company in the healthcare software sector as a Governance Risk & Compliance Analyst, where you’ll operationalize security and compliance programs. Collaborate with various teams, manage audits, and ensure robust processes for risk management while enjoying competitive benefits and a flexible work environment.

Benefits

Flexible work schedule

Generous leave package

Medical, dental, and vision insurance

401(k) company match

One-time workspace reimbursement

Qualifications

• 5+ years of experience in information security, with emphasis on risk and compliance.
• At least 3+ years managing SOC2 and HITRUST audits.
• Thorough understanding of regulatory and compliance requirements like HIPAA.

Responsibilities

• Manage SOC2 and HITRUST audits including readiness assessments.
• Conduct risk and vulnerability assessments aligned to NIST, HITRUST, HIPAA.
• Promote implementation of HITRUST and NIST based controls.

Skills

Risk and vulnerability assessments

Audit management

Compliance reviews

Communication skills

Education

Bachelor’s degree in information security or related field

Tools

GRC tools (e.g., Drata, Vanta, OneTrust)

Job description

Join to apply for the Governance Risk & Compliance Analyst role at DoseSpot

Join to apply for the Governance Risk & Compliance Analyst role at DoseSpot

This range is provided by DoseSpot. Your actual pay will be based on your skills and experience — talk with your recruiter to learn more.

Base pay range

$115,765.00/yr - $154,353.00/yr

Who We Are:

PE-backed start-up, DoseSpot is a dynamic and innovative leader in the electronic prescribing software market, and its subsidiary, pVerify, is an industry leading insurance verification solution. We are on a hyper-growth curve at the intersection of the software and healthcare industries. We need great team members to capitalize on these opportunities and improve the healthcare experience for patients and doctors alike. DoseSpot and pVerify have an exciting opportunity to join a fun and growing team, benefit from strong market tailwinds, and be part of an exciting opportunity to ensure mission-critical prescriptions and verifications are delivered on time and without error.

The Role:

As the Governance Risk & Compliance (GRC) Analyst, you will be a critical force in operationalizing and evolving DoseSpot’s security and compliance programs. You’ll collaborate cross-functionally to drive alignment and industry frameworks, proactively manage risk, and build scalable processes that keep us audit-ready and patient data secure. You’ll own day-to-day of compliance operations – from SOC 2 and HITRUST audits, to refining third-party risk assessments, to supporting the transformation of DoseSpot’s compliance program.

We welcome applicants from all U.S. time zones, though we have a preference for those based in Central or Eastern time zones.

What you'll do:

• Managed risk and vulnerability assessments, validation testing, compliance reviews, and audit in accordance with both NIST and HITRUST standards.
• Manage and support SOC2 and HITRUST audits.
• Conduct and manage recurring risk and vulnerability assessments, control validation, and compliance reviews aligned to NIST, HITRUST, HIPAA, and ISO 27001.
• Lead end to end SOC2 and HITRUST audits, including readiness assessments, evidence collection, gap remediation, and audit response.
• Proactively manage audit timelines and ensure completeness and accuracy of submissions using GRC tools such as Drata and Vanta.
• Promote widespread implementation of HITRUST and NIST based controls across security, engineering, and business operations.
• Maintain an organized, audit-ready repository of evidence and artifacts through GRC platforms.
• Inform stakeholders of risk management concerns.
• Translate risk and compliance insights into clear, actionable updates for security, IT, product, and legal teams.
• Manage the development, maintenance, and version control of security policies and standards ensuring compliance with emerging regulations and company practices
• Support vendor due-diligence process and help to lead and define the overall third-party risk management (TPRM) efforts.
  
  

What you'll bring:

• Bachelor’s degree in information security or related field.
• 5+ years of experience in information security, with an emphasis on risk and compliance.
• At least 3+ years of experience managing SOC2 and HITRUST audits
• Thorough understanding of regulatory and compliance requirements, including HIPAA
• Familiarity with ISMS and security frameworks, including NIST, HITRUST, ISO27001
• Knowledge of identity management standards, storage, and disaster recovery in the cloud.
• Knowledge of GRC tools and best practices, including solutions such as Vanta, Drata, OneTrust
• Proven track record of organizing and carrying out several risk and compliance projects independently.
• Ability to manage third-party audits and organize audit responses in detail proactively.
• Effective written and verbal communication skills and capability to communication and collaborate with cross-functional teams
• CISA, CISM, CRISM, or CISSP certifications are preferred, but not required.
  
  

You Will Enjoy This Role If:

• You like to be hands on and work with GRC tools to better automate and operationalize GRC programs.
• You enjoy collaborating with teams on risk management.
  
  

Benefits & Perks:

Remote work environment with a flexible work schedule to encourage work-life balance

Annual company offsite

Generous leave package including flexible time off policy that encourages team members to take time off to relax and recharge; plus 13 paid holidays, paid sick leave, and paid parental leave

Medical, dental, and vision insurance for you and your family, plus a company funded FSA & HSA (dependent on which medical plan you choose)

401(k) company match

One-time workspace reimbursement to help you optimize your remote workspace

DoseSpot is an Equal Employment Opportunity/Affirmative Action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, protected veteran status, disability status, sexual orientation, gender identity or expression, marital status, genetic information, or any other characteristic protected by law.

Compensation Range: $115.8K - $154.4K

Seniority level

• Seniority level

  Mid-Senior level

Employment type

• Employment type

  Full-time

Job function

• Job function

  Legal

• Industries

  Software Development

Referrals increase your chances of interviewing at DoseSpot by 2x

Sign in to set job alerts for “Compliance Analyst” roles.

Cybersecurity Governance, Risk & Compliance Specialist

Boston, MA $100,000.00-$130,000.00 4 days ago

Vice President, Chief Compliance and Privacy Officer

Associate Director or Director, Compliance Counsel

Boston, MA $180,100.00-$293,638.00 5 days ago

Scientific Business Analyst, Scientific AI

Access Architect - Epic Cadence Certified - Fully Remote

Remote Retirement Plan Compliance Analyst

Boston, MA $70,000.00-$100,000.00 2 weeks ago

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.