Lead Governance, Risk and Compliance Manager

coherehealth; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Cohere Health is seeking an experienced Lead Governance, Risk and Compliance (GRC) Manager to mature our enterprise security governance, risk management, regulatory compliance, and customer assurance programs. You will drive scalable processes and partner with Security, Legal, Sales, and Customer Success to advance our security posture and support business growth.

This hands-on leadership role requires independent delivery of complex initiatives, strong cross-functional influence, and a focus on

Qualifications

• 8+ years in information security, governance, risk management, compliance, or IT audit.
• 2+ years leading GRC initiatives or teams.
• Deep knowledge of HITRUST, ISO 27001, and HIPAA; managing assessments and audits.
• Experience deploying and administering enterprise GRC platforms (implementation, mapping, evidence, reporting).
• Familiarity with NIST frameworks and privacy-related security requirements.
• Strong project management, roadmaps, KPIs, and independent delivery.
• Proven experience with customer assurance programs (security questionnaires, audits).
• Experience with enterprise GRC tools (Vanta, ZenGRC, Drata, ServiceNow GRC).
• Excellent written/verbal communication and executive reporting skills.

Responsibilities

• Lead and mature Cohere's GRC program with scalable governance, policies, risk management, and KPIs.
• Own deployment and optimization of enterprise GRC platforms; map controls, automate evidence, manage risk registers, monitor, and report.
• Direct HITRUST, HIPAA, ISO 27001 compliance initiatives; ensure audit readiness and control execution.
• Lead customer security assurance: questionnaires, due diligence, audits, executive briefings with clients.
• Partner with Sales/CS/Marketing to create security GTM materials, Trust Center, and strengthen security as a differentiator.
• Negotiate security contract requirements with Legal, including DPAs, BAAs, exhibits.
• Oversee risk management: assessments, remediation tracking, exceptions, SLAs across Eng, Platform, DevOps, Data.
• Govern identity and access compliance: reviews, privileged certs, separation of duties, remediation.
• Establish cross-functional GRC engagement aligning policies, controls, ownership with operations.
• Deliver executive dashboards and reports on compliance posture, risk, remediation, and assurance metrics.
• Build and scale GRC function with repeatable processes, team capability, external assessors, continuous improvement.

Skills

GRC leadership

InfoSec

Risk management

Regulatory compliance

Audit readiness

Vendor risk

Security frameworks

Cross-functional leadership

Education

CISM

CISSP

CRISC

CISA

HITRUST CCSFP

Tools

Vanta

ZenGRC

Drata

ServiceNow GRC

Anecdotes

Job description

Opportunity Overview

We're looking for an experienced Lead Governance, Risk and Compliance (GRC) Manager to lead and mature our enterprise security governance, risk management, regulatory compliance, and customer assurance programs. In this role, you will drive operational excellence across compliance frameworks, security risk management, third-party assurance, and customer-facing security initiatives while strengthening the processes and technology that support our growing business.

This is a hands-on leadership role suited for an experienced GRC professional who can independently manage complex initiatives, influence cross-functional stakeholders, and build scalable, repeatable operations. You'll work closely with Security, Engineering, IT, Legal, Sales, Customer Success, and executive leadership to advance our security posture, accelerate customer trust, and enable business growth.

What you'll do

• Lead and mature Cohere's GRC program, establishing scalable governance processes, operating procedures, risk management practices, and measurable performance indicators aligned with business objectives.
• Own the deployment, configuration, and optimization of enterprise GRC platforms, including control mapping, evidence automation, risk registers, continuous monitoring, and compliance reporting.
• Direct compliance and certification initiatives across HITRUST, HIPAA, ISO 27001, and applicable regulatory requirements, ensuring ongoing audit readiness and effective control execution.
• Lead customer security assurance activities, including security questionnaires, due diligence requests, customer audits, executive briefings, and security discussions with prospective and existing clients.
• Partner with Sales, Customer Success, and Marketing to develop security-focused go-to-market materials, establish and maintain a customer-facing Trust Center, and strengthen security as a competitive differentiator.
• Review and negotiate security-related contractual requirements in partnership with Legal, including Data Protection Agreements (DPAs), Business Associate Agreements (BAAs), security exhibits, and customer security obligations.
• Oversee enterprise risk management activities, including risk assessments, remediation tracking, exception management, and the enforcement and reporting of vulnerability remediation SLAs across Engineering, Platform, DevOps, and Data teams.
• Govern identity and access compliance, including periodic access reviews, privileged access certifications, segregation of duties, and remediation of access control deficiencies.
• Establish and maintain cross-functional GRC engagement with business units to align security policies, controls, risk ownership, and compliance obligations with operational priorities.
• Develop and deliver executive-level presentations, dashboards, and reporting that communicate compliance posture, risk exposure, remediation performance, customer assurance metrics, and program maturity.
• Build and scale a high-performing GRC function, establishing repeatable processes, developing team capabilities, managing external assessors and partners, and driving continuous improvement with minimal day-to-day oversight.

What you'll need

• 8+ years of progressive experience in information security, governance, risk management, compliance, or IT audit, including 2+ years leading GRC initiatives, programs, and/or teams.
• Professional certifications such as CISM, CISSP, CRISC, CISA, CGRC, or HITRUST CCSFP.
• Deep working knowledge of HITRUST, ISO 27001, and HIPAA including direct experience managing assessments, implementing controls, coordinating audits, and maintaining certification readiness.
• Demonstrated experience deploying and administering enterprise GRC platforms, including implementation, workflow design, control mapping, evidence collection, reporting, and process automation.
• Familiarity with the NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO 27017, ISO 27018, ISO 42001, and privacy-related security requirements.
• Deep understanding of enterprise risk management, including risk registers, control assessments, risk treatment plans, vulnerability remediation SLAs, and formal exception management.
• Demonstrated project and program management capabilities, including managing concurrent initiatives, developing operational roadmaps, establishing KPIs, and delivering results independently.
• Proven experience leading customer assurance programs, including security questionnaires, customer-facing security meetings, due diligence reviews, and responding to enterprise customer requirements.
• Experience with GRC platforms such as Vanta, Anecdotes, ZenGRC, Drata, ServiceNow GRC, or similar enterprise solutions.
• Demonstrated success developing GRC program maturity models, executive scorecards, and risk-based reporting frameworks.
• Excellent written and verbal communication, executive presentation, and analytical reporting skills, with the ability to translate complex secur