Sr. GRC Analyst

Garner Health; United States; Remote; USD 155,000 - 185,000; Full time

Benefits offered by this job

Equity incentive

Flexible PTO

Medical/Dental/Vision plan

401(k)

Job summary

Garner Health is seeking a Senior GRC Analyst to join our Technical Compliance team to ensure our security controls meet ISO 27001, SOC 2, HITRUST, and HIPAA requirements. You will lead internal audits, guide external assessments, and collaborate with Engineering, Product, People, and Legal to keep controls effective and scalable.

The role is remote across the U.S. with inherited hybrid options for NYC-based candidates.

Qualifications

• 5+ years of experience in GRC, IT audit, or information security compliance.
• Experience with HITRUST, SOC 2, and ISO 27001 audits.
• Hands-on control design, evidence collection, and remediation in a cloud-native environment.
• Proven ability to adapt communication across engineers, operators, and executives.
• GRC engineering mindset with scripting and LLMs to automate repetitive tasks.
• Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred.

Responsibilities

• Manage and support compliance certifications, including SOC 2, HITRUST, and ISO 27001 audits and run control testing across the audit lifecycle
• Serve as the subject matter expert across the company on our compliance frameworks
• Serve as the primary point of contact for external auditors and assessors
• Manage Garner’s Security and Privacy trust center
• Maintain the risk register and drive risk identification, scoring, and reporting
• Maintain the maintenance of our compliance policies, standards, and procedures
• Report on our compliance posture to senior leadership
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest

Skills

GRC

IT audit

Information security

Education

Certifications: CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor

Tools

Scripting

LLMs

Job description

Garner is on a mission to transform the U.S. healthcare system - and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster.

The result is a rare "win win" - better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. - and using AI to scale that impact further and faster than anyone else can.

About the role:

We are looking for a Senior GRC Analyst to join our Technical Compliance team to ensure Garner’s compliance posture across security frameworks such as ISO 27001, SOC 2, HITRUST, and HIPAA. As a Senior GRC Analyst you will run our internal audits, guide our external assessments, and partner with teams across Engineering, Product, People, and Legal so that our controls are designed well, operating effectively, and continuously improving. Our Technical Compliance team safeguards Garner’s sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow.

Where you will work:

This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week.

What you will do:

• Manage and support our compliance certifications, including SOC 2, HITRUST, and ISO 27001 audits and run control testing across the audit lifecycle
• Serve as the subject matter expert across the company on our compliance frameworks
• Serve as the primary point of contact for external auditors and assessors
• Manage Garner’s Security and Privacy trust center
• Maintain the risk register and drive risk identification, scoring, and reporting
• Manage the maintenance of our compliance policies, standards, and procedures
• Report on our compliance posture to senior leadership
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest

What you will bring to the team:

• 5+ years of experience in GRC, IT audit, or information security compliance
• Prior experience with HITRUST, SOC 2, and ISO 27001 audits
• Hands-on experience with control design, evidence collection, and remediation in a cloud-native engineering environment
• Proven ability to adapt your communication style across engineers, operators, and executives
• A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks
• A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback
• Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred

Technologies we use:

Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time.

Compensation Transparency:

The target salary range for this position is $155,000 - $185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k), Teladoc Health and more.

Equal Employment Opportunity:

Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics.

Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at [e-mail].

U.S. Standard Demographic Questions

We invite applicants to share their demographic background. If you choose to complete this survey, your responses may be used to identify areas of improvement in our hiring process.

How would you describe your gender identity? (mark all that apply) Select...

How would you describe your racial/ethnic background? (mark all that apply) Select...

How would you describe your sexual orientation? (mark all that apply) Select...

Do you identify as transgender? Select...

Do you have a disability or chronic condition (physical, visual, auditory, cognitive, mental, emotional, or other) that substantially limits one or more of your major life activities, including mobility, communication (seeing, hearing, speaking), and learning? Select...

Are you a veteran or active member of the United States Armed Forces? Select...