Senior GRC Analyst - AI Governance & SOC 2 Lead

Apply; San Francisco (CA); Hybrid; USD 150,000 - 210,000; Full time

Benefits offered by this job

Medical, Dental, Vision coverage

401(k) with company match

Remote-friendly culture with SF HQ

Parental leave

Off-sites and team gatherings

Flexible time off

Job summary

Ambience is seeking a Senior GRC Analyst to own governance, risk, and compliance for a health-tech SaaS. You’ll lead SOC 2 from evidence collection to auditor sign-off, and shape PHI governance, vendor risk, and AI-model risk.

You’ll work with engineering, legal, and customers in a fast-paced startup environment, using AI coding tools to answer compliance questions from code and drive auditable security outcomes.

Qualifications

• SOC 2 ownership in a SaaS environment with audit from evidence collection to sign-off.
• Ability to threat-model a new vendor: data flows, touched data, required controls.
• Policy and standards writing that auditors and engineers can actually use.

Responsibilities

• Own the compliance program end to end, including SOC 2 audits and auditor relationships.
• Lead PHI governance, inventory PHI locations and interfaces with HIPAA controls.
• Investigate controls with AI-assisted tooling to verify implementations and provide evidentiary answers.
• Manage vendor and AI-model risk reviews, coordinating with legal and finance for risk assessments.
• Drive risk closure with engineering on an auditable cadence and publish security/compliance policies.

Skills

SOC 2 ownership

GRC automation

Threat modeling

Policy writing

Tools

Vanta

Drata

Job description

Ambience is seeking a Senior GRC Analyst to own governance, risk, and compliance for a health-tech SaaS. You’ll lead SOC 2 from evidence collection to auditor sign-off, and shape PHI governance, vendor risk, and AI-model risk.

You’ll work with engineering, legal, and customers in a fast-paced startup environment, using AI coding tools to answer compliance questions from code and drive auditable security outcomes.