Sr. GRC Analyst - Internal Governance

garnerhealth; United States; Remote; USD 155,000 - 185,000; Full time

Benefits offered by this job

Flexible PTO

Medical/Dental/Vision

401(k) with company match

Flexible spending accounts

Teladoc Health

Job summary

Garner Health is hiring a Senior GRC Analyst to own risk governance, third-party risk and security findings. You’ll drive risk assessment, manage risk acceptances, and coordinate remediation with Engineering in a fast-paced, mission-driven environment.

The role emphasizes HIPAA/compliance training and a strong control framework across the organization. Remote-friendly across the United States, with occasional coordination for audits and leadership reviews.

Qualifications

• 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance.

Responsibilities

• Own Garner's annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting.
• Manage risk exceptions and prepare risk acceptances for leadership decision.
• Run third party and vendor risk reviews from intake through approval and periodic reassessment.
• Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision.
• Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking.
• Manage the maintenance of our compliance policies, standards, and procedures.
• Report on our compliance posture to senior leadership.
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest.

Skills

GRC

IT risk management

Vendor risk management

Info security

SOC 2 knowledge

ISO27001 knowledge

HIPAA knowledge

Communication across teams

Scripting

LLM automation

Education

Bachelor’s degree or equivalent

Tools

AWS

Okta

Wiz

Retool

GitLab

Vanta

Claude

Job description

What you\'ll be part of

Garner is on a mission to transform the U.S. healthcare system - and we\'re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster.

The result is a rare "win win" - better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you\'ve ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You\'d be joining a team fundamentally reimagining healthcare in the U.S. - and using AI to scale that impact further and faster than anyone else can.

About the role

We are looking for a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner\'s security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program. You will partner with all departments across the company so that risks are identified early, decisions are made deliberately, and remediation actually gets done. Our Technology Compliance team safeguards Garner\'s sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow.

Where you will work

This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week.

What you will do

• Own Garner\'s annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting
• Manage risk exceptions and prepare risk acceptances for leadership decision
• Run third party and vendor risk reviews from intake through approval and periodic reassessment
• Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision
• Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking
• Manage the maintenance of our compliance policies, standards, and procedures
• Report on our compliance posture to senior leadership
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest

What you will bring to the team

• 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance
• Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005
• Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment
• Working knowledge of HIPAA and of SOC 2, ISO 27001, and HITRUST requirements
• A track record of driving accountability across teams you don\'t manage, and the ability to adapt your communication style across engineers, operators, and executives
• A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks
• A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback
• Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred

Technologies we use

• AWS
• Okta
• Wiz
• Retool
• Gitlab
• Vanta
• Claude

Please note

we are unable to sponsor or take over sponsorship of an employment visa at this time.

Compensation Transparency

The target salary range for this position is $155,000-185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to:

• flexible PTO
• Medical/Dental/Vision plan options
• 401(k) with company match
• flexible spending accounts
• Teladoc Health
• and more