Lead Security, GRC & Compliance Strategist

Tech Jobs for Good; United States; Hybrid; USD 150,000 - 215,000; Full time

Benefits offered by this job

Stock options

Health insurance

401k

Paid time off

Job summary

Collective Health is seeking a Lead Security Analyst - GRC to drive governance, risk and compliance initiatives across the business. You will partner with teams to implement controls aligned with NIST, CIS, HIPAA, SOC 2 and HITRUST, building scalable security programs.

You will own audit readiness, coordinate third-party assessments, and deliver executive reporting on program health and risk. The role requires strong communication and cross-functional collaboration in a hybrid, US-based

Qualifications

• 8+ years in cybersecurity, GRC, audit or risk/compliance roles.
• Experience managing SOC 2 / HITRUST audits in cloud-native environments.
• Strong knowledge of security frameworks and regulatory requirements.

Responsibilities

• Evaluate and implement security controls based on NIST, CIS, HIPAA, SOC 2, and HITRUST.
• Lead SOC 2 and HITRUST audit engagements from planning through remediation.
• Coordinate third-party risk assessments and compliance reviews.
• Educate control/risk owners and provide executive status reporting.

Skills

Cybersecurity

GRC

Audit

Risk management

Policy development

Regulatory knowledge

Cross-functional collaboration

Communication

Education

Certifications: CISSP, CISA, CRISC, CISM

Tools

GRC tools

Job description

Collective Health is seeking a Lead Security Analyst - GRC to drive governance, risk and compliance initiatives across the business. You will partner with teams to implement controls aligned with NIST, CIS, HIPAA, SOC 2 and HITRUST, building scalable security programs.

You will own audit readiness, coordinate third-party assessments, and deliver executive reporting on program health and risk. The role requires strong communication and cross-functional collaboration in a hybrid, US-based