GRC Manager: SOC2/HITRUST Security Leader

Femtech Insider Ltd.; Town of Texas (WI); Hybrid; USD 170,000 - 201,000; Full time

Benefits offered by this job

Hybrid work model

Equity

16 weeks paid parental leave

Professional development stipend

Career coaching

401K matching

Job summary

Maven Clinic is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You will lead the GRC function, work with Engineering, IT, HR, Legal, and Sales to gather evidence, close gaps, and manage audits and certifications.

You will drive SOC 2, HITRUST, ISO 27001 programs, respond to customer RFIs, and maintain security knowledge bases. This role reports to the CISO and shapes our compliance posture across enterprise engagements.

Qualifications

• Experience owning at least one SOC 2 or similar audit cycle end-to-end.
• Hands-on knowledge of SOC 2, HITRUST, and ISO 27001 frameworks.
• Experience responding to customer security questionnaires/RFIs in a B2B SaaS or healthcare-adjacent environment.
• Strong cross-team collaboration with Engineering, IT, HR, Legal and Sales.
• Solid project management: sequencing audits, tracking remediation and deadlines.

Responsibilities

• Own continuation and renewal of SOC 2 (Type II) and HITRUST certifications end-to-end.
• Lead ISO 27001 and ISO 42001 programs, including gap assessments and policy writing.
• Manage audit calendar and coordinate evidence with stakeholders.
• Translate regulatory changes into control updates.
• Serve as primary owner of security questionnaires and RFIs/RFPs for Sales and Customer Success.
• Maintain security knowledge base and partner with teams for customer calls when security is a blocker.

Skills

GRC management

Security compliance

Audits

Policies writing

Cross-team collaboration

Project management

Security risk assessment

Education

CISA certification

CRISC certification

CISSP certification

PMP / CAPM

CISM certification

Tools

Vanta

Drata

Secureframe

Hyperproof

Job description

Maven Clinic is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You will lead the GRC function, work with Engineering, IT, HR, Legal, and Sales to gather evidence, close gaps, and manage audits and certifications.

You will drive SOC 2, HITRUST, ISO 27001 programs, respond to customer RFIs, and maintain security knowledge bases. This role reports to the CISO and shapes our compliance posture across enterprise engagements.