GRC Lead: Security & Compliance (SOC2/HITRUST)

Maven Clinic; New York (NY); Hybrid; USD 170,000 - 201,000; Full time

Benefits offered by this job

Hybrid work model

Parental leave

Professional development stipend

401K matching

Job summary

Maven Clinic is a leading virtual clinic for women and families, with a strong focus on security and compliance for its B2B health benefits platform. The GRC Manager will own governance, risk, and compliance, coordinating audits, policies, RFIs, and controls across engineering, IT, HR, and legal teams.

You will report to the CISO/Head of Security, partner with Sales and Customer Success on security questionnaires, and drive remediation and ongoing monitoring to support enterprise and health-plan

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit with ownership of an audit cycle.
• Hands-on knowledge of SOC 2, HITRUST, and ISO 27001 frameworks.
• Experience responding to customer security questionnaires/RFIs in a B2B SaaS or healthcare-adjacent environment.
• Strong cross-team collaboration across Engineering, IT, HR, Legal, and Sales.
• Excellent project management, ability to sequence audits, and meet deadlines.
• Strong written communication for policies and audit narratives.

Responsibilities

• Own continuation and renewal of SOC 2 (Type II) and HITRUST end-to-end; scope cycles, gather evidence, coordinate with auditors, track remediation.
• Lead ISO 27001 and ISO 42001 programs; perform gap assessments, policy writing, and readiness for audits.
• Manage the audit calendar with stakeholders to close findings on time.
• Track regulatory changes and translate into control updates.

Skills

GRC management

SOC 2 & HITRUST

ISO 27001

RFI responses

Cross-team collaboration

Project management

Security writing

Tools

Vanta

Drata

Secureframe

Hyperproof

Job description

Maven Clinic is a leading virtual clinic for women and families, with a strong focus on security and compliance for its B2B health benefits platform. The GRC Manager will own governance, risk, and compliance, coordinating audits, policies, RFIs, and controls across engineering, IT, HR, and legal teams.

You will report to the CISO/Head of Security, partner with Sales and Customer Success on security questionnaires, and drive remediation and ongoing monitoring to support enterprise and health-plan