GRC Program Lead — Health Tech Security & Compliance

Maven Clinic; United States; On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Parental leave

401K matching

Professional development stipend

Wellness partnerships

Maven platform access

Job summary

Maven Clinic in the United States is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You’ll lead the GRC function, collaborate with Engineering, IT, and HR to gather evidence, close gaps, and manage auditor relationships during certification cycles.

You will drive audit sequencing, remediation tracking, and policy development, serve as the primary security/compliance voice in customer discussions, and ensure timely responses to RFIs and

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Direct ownership of at least one SOC 2 or similar audit cycle.
• Experience with SOC 2, HITRUST, and ISO 27001.
• Strong written communication; drafting policies and audit narratives.
• Background in health tech or regulated B2B environments.

Responsibilities

• Lead audits and verify controls end-to-end.
• Write policies and respond to RFIs and audit requests.
• Manage auditor relationships through certification cycles.
• Coordinate evidence gathering with Engineering, IT, and HR.
• Track remediation and meet deadlines across concurrent workstreams.
• Own security questionnaires for Sales and Customer Success teams.

Skills

GRC

SOC 2

HITRUST

ISO 27001

Audits

Policy writing

RFI responses

Project management

Vendor risk

Security frameworks

Communication

Tools

Vanta

Drata

Secureframe

Hyperproof

Job description

Maven Clinic in the United States is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You’ll lead the GRC function, collaborate with Engineering, IT, and HR to gather evidence, close gaps, and manage auditor relationships during certification cycles.

You will drive audit sequencing, remediation tracking, and policy development, serve as the primary security/compliance voice in customer discussions, and ensure timely responses to RFIs and