GRC Leader: SOC 2, HITRUST & ISO 27001 Expert

Maven Clinic Co.; New York, Northern (NY, KY); Hybrid; USD 170,000 - 201,000; Full time

Benefits offered by this job

Hybrid work model

Parental leave & family support

401K matching

Job summary

Maven Clinic, a leading virtual health platform for women and families, seeks a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You will lead audits, write policies, answer RFIs, and monitor controls while partnering with Engineering, IT, and HR to close gaps.

You will manage customer security questionnaires, support due diligence with auditors, and drive certification programs across SOC 2, HITRUST, ISO 27001, and ISO 42001 as the company scales.

Qualifications

• 6+ years in GRC, information security compliance, or IT audit with ownership of at least one SOC 2 or similar cycle.
• Hands-on knowledge of SOC 2, HITRUST, ISO 27001 frameworks.
• Experience responding to customer security questionnaires/RFIs in a B2B SaaS or healthcare-adjacent environment.
• Strong cross-team collaboration across Engineering, IT, HR, Legal, and Sales.
• Solid project management to sequence audits, track remediation, and meet deadlines.
• Excellent written communication for policies, RFIs, and audit narratives.

Responsibilities

• Own SOC 2 (Type II) and HITRUST certifications end-to-end.
• Lead ISO 27001 and ISO 42001 programs with gap assessments and control mapping.
• Manage annual audit calendar with cross-functional coordination.
• Translate regulatory changes into control updates.

Skills

GRC

Security audits

Policy writing

Cross-functional collaboration

Project management

Education

CISA

CRISC

CISSP

PMP

Tools

Vanta

Drata

Secureframe

Hyperproof

Job description

Maven Clinic, a leading virtual health platform for women and families, seeks a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You will lead audits, write policies, answer RFIs, and monitor controls while partnering with Engineering, IT, and HR to close gaps.

You will manage customer security questionnaires, support due diligence with auditors, and drive certification programs across SOC 2, HITRUST, ISO 27001, and ISO 42001 as the company scales.