Hybrid GRC Manager: Enterprise Security & Compliance

Maven Clinic; United States; Hybrid; USD 170,000 - 201,000; Full time

Benefits offered by this job

Hybrid work model

Parental leave

Professional development stipend

401K matching

Job summary

Maven Clinic is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You’ll lead audits, write policies, respond to RFIs, and monitor controls day-to-day, reporting to the CISO.

You’ll partner with Engineering, IT, and HR to gather evidence, manage auditor relationships, and ensure on-time remediation across multiple workstreams. Hybrid work is available across NY metro and other cities.

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Hands-on knowledge of SOC 2, HITRUST, and ISO 27001 frameworks.
• Experience responding to customer security questionnaires/RFIs, ideally in a B2B SaaS or healthcare-adjacent environment.
• Strong cross-team collaboration with Engineering, IT, HR, Legal, and Sales.
• Solid project management: sequence overlapping audits and certification projects, track dependencies and remediation items.
• Strong written communication for policies, RFI responses, and audit narratives.

Responsibilities

• Own continuation and renewal of SOC 2 (Type II) and HITRUST certifications end-to-end.
• Lead ISO 27001 and ISO 42001 certification programs with gap assessments and policy statements.
• Manage the annual audit calendar across frameworks and coordinate with stakeholders.
• Track regulatory changes (HIPAA, state privacy laws, ISO updates) and translate to controls.
• Serve as primary owner of security questionnaires and RFIs for Sales and CS.
• Maintain a security knowledge base to reduce response times.

Skills

Project management

Cross-team collaboration

Policy writing

Auditing

Tools

Vanta

Drata

Secureframe

Hyperproof

Job description

Maven Clinic is seeking a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You’ll lead audits, write policies, respond to RFIs, and monitor controls day-to-day, reporting to the CISO.

You’ll partner with Engineering, IT, and HR to gather evidence, manage auditor relationships, and ensure on-time remediation across multiple workstreams. Hybrid work is available across NY metro and other cities.