Remote GRC Analyst - SOC 2, HIPAA & HITRUST, Equity

Ceresti Health; United States; Remote; USD 80,000 - 110,000; Full time

Benefits offered by this job

Full‑time remote work

Competitive base salary

Health, dental, and vision benefits

Equity participation

PTO

Mission‑driven environment

Job summary

Ceresti Health is seeking a GRC Analyst to document and evidence our security controls, supporting SOC 2, HITRUST, and HIPAA obligations. You will gather audit artifacts, update policies, and perform vendor risk assessments in collaboration with Security, IT, Engineering, and Operations.

This role is an early-career opportunity to contribute to a regulated healthcare company, with remote work, growth opportunities, and exposure to our comprehensive privacy program.

Qualifications

• One to three years of experience in governance, risk and compliance, audit, or a related field.
• Knowledge of SOC 2, HITRUST, or HIPAA frameworks and willingness to learn others.
• Clear, precise writing and attention to detail.
• Ability to track multiple items to completion.
• Comfort following up with colleagues for evidence.

Responsibilities

• Collect SOC 2 Type 2 and HITRUST audit evidence.
• Track control evidence status and report to CISO.
• Coordinate with control owners to gather artifacts.
• Update security and privacy policies, manage versions, and track acknowledgement.
• Perform third‑party vendor risk assessments and document findings.
• Support HIPAA and other healthcare compliance obligations.

Skills

Governance, risk & compliance

Audit

SOC 2

HITRUST

HIPAA

Written communication

Education

Bachelor's degree in a relevant field

Job description

Ceresti Health is seeking a GRC Analyst to document and evidence our security controls, supporting SOC 2, HITRUST, and HIPAA obligations. You will gather audit artifacts, update policies, and perform vendor risk assessments in collaboration with Security, IT, Engineering, and Operations.

This role is an early-career opportunity to contribute to a regulated healthcare company, with remote work, growth opportunities, and exposure to our comprehensive privacy program.