Sr. GRC Analyst

Garner is on a mission to transform the U.S. healthcare system by partnering with employers to redesign how healthcare works, applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients. We are looking for a Senior GRC Analyst to join our Technical Compliance team to ensure Garner's compliance posture across security frameworks such as ISO 27001, SOC 2, HITRUST, and HIPAA. As a Senior GRC Analyst you will run internal audits, guide external assessments, and partner with teams across Engineering, Product, People, and Legal. This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week. Technologies used: AWS, Okta, Datadog, Retool, Gitlab, Vanta, Claude. Target salary range: $155,000 - $185,000.

Responsibilities

Manage and support compliance certifications, including SOC 2, HITRUST, and ISO 27001 audits and run control testing across the audit lifecycle; Serve as the subject matter expert across the company on compliance frameworks; Serve as the primary point of contact for external auditors and assessors; Manage Garner's Security and Privacy trust center; Maintain the risk register and drive risk identification, scoring, and reporting; Manage the maintenance of compliance policies, standards, and procedures; Report on compliance posture to senior leadership; Scale the GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest

Requirements

5+ years of experience in GRC, IT audit, or information security compliance; Prior experience with HITRUST, SOC 2, and ISO 27001 audits; Hands-on experience with control design, evidence collection, and remediation in a cloud-native engineering environment; Proven ability to adapt your communication style across engineers, operators, and executives; A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks; A desire to be part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback; Unable to sponsor or take over sponsorship of an employment visa

Nice to have

Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor

Benefits

Equity incentive plan; Flexible PTO; Medical/Dental/Vision plan options; 401(k); Teladoc Health