GRC Analyst

Ceresti Health; United States; Remote; USD 70,000 - 100,000; Full time

Benefits offered by this job

Full‑time remote

Competitive base salary

Health, dental, vision benefits

Equity participation

PTO

Collaborative, mission‑driven culture

Job summary

Ceresti Health is seeking a GRC Analyst to turn security work into auditable, evidence-based documentation supporting SOC 2, HITRUST, and HIPAA obligations. You'll report to the CISO and collaborate with Security, IT, Engineering, and Operations to gather artifacts, update policies, assess vendors, and support privacy programs.

This entry‑to‑mid level role offers exposure to the full security program in a regulated healthcare environment, with growth opportunities as you learn and contribute

Qualifications

• 1–3 years of experience in governance, risk and compliance, audit, or a related field.
• Working knowledge of SOC 2, HITRUST, or HIPAA; willingness to learn the others.
• Clear, precise writing and ability to produce document‑level outputs.
• Strong attention to detail with ability to track many items to completion.
• Comfort following up with colleagues for evidence without being pushy.

Responsibilities

• Audit evidence and control documentation for SOC 2 Type 2 and HITRUST.
• Policy and vendor risk management, including policy updates and third‑party assessments.
• Privacy and data lifecycle support for HIPAA and related obligations.

Skills

Governance, risk & compliance

SOC 2/HITRUST/HIPAA knowledge

Clear writing

Attention to detail

Stakeholder follow-up

Job description

About Ceresti

Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. We envision a world in which family caregivers of people living with dementia are supported and have the knowledge, skills, and confidence to provide the best possible care for their loved ones.

Ceresti is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. We offer health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs.

Our culture is rooted in agility, innovation, and collaboration. We believe every idea—no matter how small—can spark a meaningful improvement. Together, we create solutions that make a lasting impact on the healthcare ecosystem, enabling more compassionate and cost-effective care for those who need it most.

The Role

Ceresti's security and privacy controls only count if we can prove they work. As GRC Analyst, you turn what the security team does every day into documented, audit-ready evidence — the record behind our SOC 2, HITRUST, and HIPAA obligations.

You will report to the Chief Information Security Officer and work across Security, IT, Engineering, and Operations: gathering evidence, keeping policies current, assessing vendors, and supporting the privacy and data program. This is the governance side of security. The Security Analyst operates and monitors the controls; you prove they are working.

This role is targeted to someone early in their career who is organized, writes clearly, and wants to learn how a regulated healthcare company earns and keeps its certifications. You will have a lot of exposure to the entire security program.

What You Will Do

Audit evidence and control documentation

• Collect evidence for SOC 2 Type 2 and HITRUST including internal audit testing of controls.
• Track control evidence status and keep the CISO informed.
• Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts.

Policy and vendor risk

• Update security and privacy policies, manage versions, and track that people have read/acknowledged them.
• Maintain documented proof that policies are being followed across the company.
• Run third‑party vendor risk assessments, document findings, and elevate anything that needs a decision.

Privacy and data lifecycle

• Support HIPAA and other healthcare compliance obligations alongside the CISO.
• Support the data retention, de‑identification, and disposal program.
• Support the Privacy and Data Program.

What Success Looks Like

In the first year, we would expect to see:

• Evidence for SOC 2 and HITRUST that is accurate, complete, and on time, with no recurring gaps.
• Policies that stay current, with documented proof people are following them.
• Vendor risk assessments finished on schedule, with risks written down and escalated appropriately.
• Retention, de‑identification, and disposal actions happening on schedule and recorded.

What You Bring

Required

• One to three years of experience in governance, risk and compliance, audit, or a related field.
• Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and the appetite to learn the others quickly.
• Clear, precise writing. Much of this role is producing documents other people depend on.
• Attention to detail, and the patience to track many small items to completion.
• Comfort following up with colleagues for evidence without being pushy.

Preferred

• Exposure to a GRC or compliance‑automation platform.
• Experience in healthcare or another regulated industry.
• Familiarity with vendor risk assessments or BAA tracking.
• External audit exposure.

How you work

• You know when to resolve something yourself, upscale, and anticipate options.
• You follow through on small commitments without being reminded.
• You ask when something is unclear instead of guessing.
• You treat compliance as something that protects patients and caregivers, not as paperwork.

What We Offer

• Full‑time remote work
• Competitive base salary with final offer based on experience, skills, and location
• Comprehensive health, dental, and vision benefits
• Equity participation in a growing healthcare technology company
• PTO and a culture that respects it
• A collaborative, mission‑driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia

Additional Information

Employment is contingent on successful completion of a background check, consistent with applicable law.

Ceresti is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law.