Senior GRC & Security Compliance Lead | Remote

Garner Health; New York (NY); Remote; USD 155,000 - 185,000; Full time

Job summary

Garner Health is seeking a Senior GRC Analyst to join our Technical Compliance team. You will own risk assessment, vendor risk, findings management, and governance to keep our security program aligned with audits, regulations, and client expectations.

You will collaborate across departments to identify risks early, drive remediation, and protect sensitive healthcare data while enabling secure growth and enterprise partnerships.

Qualifications

• 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance.
• Experience running information security risk assessments and maintaining a risk register using NIST CSF or ISO 27005.
• Hands-on vendor risk management and vulnerability/finding remediation programs in a cloud-native environment.
• Working knowledge of HIPAA and SOC 2, ISO 27001, and HITRUST requirements.
• Demonstrated ability to drive accountability across teams and communicate with engineers, operators, and executives.
• GRC engineering mindset with scripting and LLM automation to reduce repetitive tasks.
• Desire to contribute to a high-performing, mission-driven team with urgency and accountability.
• Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred.

Responsibilities

• Own Garner's annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting.
• Manage risk exceptions and prepare risk acceptances for leadership decision.
• Run third party and vendor risk reviews from intake through approval and periodic reassessment.
• Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs.
• Run security and compliance training programs, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking.
• Maintain compliance policies, standards, and procedures.
• Report on our compliance posture to senior leadership.
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to automate the rest.

Skills

GRC experience

IT risk management

Third party risk management

Information security compliance

NIST CSF / ISO 27005

Risk assessment & risk register

HIPAA, SOC 2, ISO 27001, HITRUST

Scripting & LLM automation

Cross-functional communication

Education

CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor (preferred)

Tools

AWS

Okta

Wiz

Retool

Gitlab

Vanta

Claude

Job description

Garner Health is seeking a Senior GRC Analyst to join our Technical Compliance team. You will own risk assessment, vendor risk, findings management, and governance to keep our security program aligned with audits, regulations, and client expectations.

You will collaborate across departments to identify risks early, drive remediation, and protect sensitive healthcare data while enabling secure growth and enterprise partnerships.