Security GRC Leader: SOC2/HITRUST & AI Governance

Rightway; United States; On-site; USD 144,000 - 175,000; Full time

Job summary

Rightway is seeking a Security GRC Manager to own and mature our GRC function as we scale. You will strengthen policies, streamline workflows, and lead the SOC 2 + HITRUST attestation program while guiding the GRC team.

You will partner with Legal, IT, and Privacy on data protection, HIPAA/HITECH, BAAs, and AI governance (ISO/IEC 42001). You will drive risk assessments, monitor controls in Drata, oversee contract reviews, and maintain the customer assurance program.

Qualifications

• 5–10 years of related work experience in GRC.
• CISSP, CISA, or CISM certification relevant to the role.
• Led SOC 2 with HITRUST CSF certification in a high-growth environment.
• Familiarity with AI governance frameworks (ISO/IEC 42001).
• Experience negotiating BAAs and performing four-factor breach risk assessments.
• Strong knowledge of HIPAA/HITECH and data privacy requirements.
• Ability to lead and mentor GRC analysts.

Responsibilities

• Lead and mentor a small GRC team and set priorities.
• Own and evolve the unified control library across SOC 2, SOC 1, and HITRUST.
• In partnership with stakeholders, lead audits for SOC 1, SOC 2/HITRUST, and customer audits.
• Partner with Legal on Data Privacy, BAAs, and incident analysis.
• Own AI governance program modeled after ISO/IEC 42001.
• Review security, privacy, and data protection language in customer/vendor agreements.
• Monitor control effectiveness and evidence collection in Drata.
• Improve policies and procedures to boost efficiency, security, and compliance.
• Lead business continuity planning and testing (BIA-informed).
• Revamp Third Party Risk Management program and monitor data security risks.
• Own security risk management program, risk tracking, and remediation.
• Develop security and compliance training programs.
• Maintain customer assurance program, including questionnaires and RFP responses.

Skills

GRC leadership

Risk assessment

Audit coordination

Policy development

Team mentoring

Vendor management

Education

CISSP / CISA / CISM certification

Tools

Drata

AWS

Okta

JIRA

GIT/GITHUB

CrowdStrike

Wiz

Arctic Wolf

KnowBe4

Job description

Rightway is seeking a Security GRC Manager to own and mature our GRC function as we scale. You will strengthen policies, streamline workflows, and lead the SOC 2 + HITRUST attestation program while guiding the GRC team.

You will partner with Legal, IT, and Privacy on data protection, HIPAA/HITECH, BAAs, and AI governance (ISO/IEC 42001). You will drive risk assessments, monitor controls in Drata, oversee contract reviews, and maintain the customer assurance program.