Sr. GRC Analyst - Internal Governance (Fully Remote)

Garner Health; United States; Remote; USD 110,000 - 160,000; Full time

Job summary

Garner Health is seeking a seasoned GRC/Information Security professional to own the annual risk assessment and risk register, coordinate third-party vendor risk reviews with Engineering, and manage the security training program. You will report on compliance posture to leadership and drive remediation as needed.

The role requires 5+ years in GRC or IT risk, familiarity with NIST CSF/ISO 27001/HITRUST, and a scripting/LLM automation mindset to streamline governance processes.

Qualifications

• 5+ years of experience in GRC, IT risk management, third-party risk, or information security compliance.
• Experience with NIST CSF or ISO 27005, HIPAA, SOC 2, ISO 27001, and HITRUST.
• A GRC engineering mindset with scripting and LLM automation experience.

Responsibilities

• Own the annual information security risk assessment and risk register, including risk exceptions and acceptances.
• Run third-party and vendor risk reviews and drive security findings to resolution with Engineering.
• Manage the security and compliance training program and report on compliance posture to leadership.

Skills

GRC

IT risk management

Third-party risk

Information security compliance

Tools

Scripting

LLM automation

Job description

• You will own recurring risk, vendor, findings, and governance work that keeps Garner's security program operating well between audits.
• You will partner across departments so risks are identified early, decisions are deliberate, and remediation gets done.

What you will do:

• Own the annual information security risk assessment and risk register, including risk exceptions and acceptances.
• Run third-party and vendor risk reviews and drive security findings to resolution with Engineering.
• Manage the security and compliance training program and report on compliance posture to leadership.

What you will bring:

• 5+ years of experience in GRC, IT risk management, third-party risk, or information security compliance.
• Experience with NIST CSF or ISO 27005, HIPAA, SOC 2, ISO 27001, and HITRUST.
• A GRC engineering mindset with scripting and LLM automation experience.

Garner Health

Garner partners with employers to transform U.S. healthcare by using clinical data and incentives to steer members to higher-quality, lower-cost care. The company has raised a Series E, served over 2.5 million people, and is known for a mission‑high-performing culture.