Senior GRC Lead: Risk, Audit & Compliance

Harris Computer; Oklahoma; On-site; USD 130,000 - 150,000; Full time

Benefits offered by this job

Full benefits package

Vacation and personal days

Employee stock ownership

Flexible work arrangements

RRSP program

Job summary

ClearDATA seeks a Senior GRC Manager to own the GRC program from end to end, aligning with HIPAA, GDPR, HITRUST, SOC 2 and related standards. You’ll manage the Information Security Management Program, audits, and vendor risk, collaborating with auditors and security engineers to produce defensible evidence.

You’ll partner with engineering, DevSecOps, and management to translate policy into practical, risk‑based actions while keeping documentation accurate and the control environment robust.

Qualifications

• 5+ years in GRC or IT security compliance in a regulated industry.
• Direct experience maintaining an Information Security Management Program.
• Experience working with external auditors and cross‑functional teams.
• Proven ability to translate control requirements into practical actions.

Responsibilities

• Own the GRC program end to end and maintain policies, procedures, and standards.
• Support audits, assessments, and certification renewals (HIPAA, GDPR, HITRUST, SOC 2).
• Maintain risk registers including third‑party and vendor risk.
• Keep control mapping and audit evidence current and organized.
• Collaborate with security engineers and DevSecOps to produce auditable evidence.
• Act as go‑to compliance resource across the company and leadership.

Skills

GRC

IT compliance

Information security

Auditor liaison

Policy writing

Risk management

Cross‑functional collaboration

Documentation

Tools

OneTrust

Thoropass

Job description

ClearDATA seeks a Senior GRC Manager to own the GRC program from end to end, aligning with HIPAA, GDPR, HITRUST, SOC 2 and related standards. You’ll manage the Information Security Management Program, audits, and vendor risk, collaborating with auditors and security engineers to produce defensible evidence.

You’ll partner with engineering, DevSecOps, and management to translate policy into practical, risk‑based actions while keeping documentation accurate and the control environment robust.