GRC & Privacy Compliance Lead (AI-Driven)

thriveglobal; United States; On-site; USD 115,000 - 125,000; Full time

Benefits offered by this job

Mission-Driven Impact

Career Growth

Human-Centric Culture

Competitive Compensation

Health & 401(k) benefits

Thrive Time PTO

Job summary

Thrive Global is seeking a detail-oriented GRC and Privacy Analyst to strengthen our security, compliance, and data privacy posture. In this role, you will own and operationalize compliance programs, manage audit cycles, and help embed privacy-by-design principles across a health-focused, data-sensitive organization.

This role will require mastering frameworks such as SOC 2, ISO 27001, ISO 27701, HITRUST, HIPAA, GDPR, and NIST RMF while leveraging AI tooling to streamline evidence review and

Qualifications

• Experience with GRC automation and IT security/privacy controls.
• Experience applying HIPAA and GDPR requirements in a regulated data environment.
• Ability to manage audits across multiple frameworks and coordinate with stakeholders.

Responsibilities

• Administer and optimize compliance automation like Vanta.
• Lead and support audits across frameworks with internal and external teams.
• Maintain programs mapped to SOC 2, ISO 27001, ISO 27701, HITRUST, NIST 800-53, and AI RMF.
• Interpret HIPAA/GDPR requirements and ensure compliant data handling.
• Conduct risk assessments and track remediation efforts.
• Use project management to drive timelines and deliverables.
• Leverage AI tools to improve evidence review, policy drafting, and reporting.

Skills

GRC expertise

Vanta

Audit management

HIPAA & GDPR

AI tools adoption

Communication

Certifications (CISA, CIPP)

Healthcare data security

AI governance

Education

CISA

CIPP

ISO 27001 Implementer

Tools

Vanta

Job description

Thrive Global is seeking a detail-oriented GRC and Privacy Analyst to strengthen our security, compliance, and data privacy posture. In this role, you will own and operationalize compliance programs, manage audit cycles, and help embed privacy-by-design principles across a health-focused, data-sensitive organization.

This role will require mastering frameworks such as SOC 2, ISO 27001, ISO 27701, HITRUST, HIPAA, GDPR, and NIST RMF while leveraging AI tooling to streamline evidence review and