Senior Manager, Governance, Risk, and Compliance

As our Senior Manager of GRC, you will have a high-impact, transformative opportunity to lead Virta’s Governance, Risk, and Compliance (GRC) function in a highly automated, AI-first environment. You will be the ultimate champion of security compliance and risk culture across the enterprise—collaborating closely with Sales to unblock commercial velocity, supervising compliance audits, and hardening our HIPAA, HITRUST, and SOC 2 frameworks. If you are passionate about driving risk governance, designing automated evidence collection, and enabling employees with frictionless SaaS reviews and compliance workflows, this role is your opportunity to redefine healthcare compliance.

Responsibilities

Maintain and mature Virta Health's information security compliance program, policies, procedures, and controls; Oversee Virta’s GRC function, scaling Vanta to automate continuous evidence collection and defend HIPAA, HITRUST CSF, and SOC 2 certifications; Partner with Sales and Customer Success to navigate enterprise customer evaluations and security reviews; Define and own Virta's security policy lifecycle, exception management processes, vendor risk assessments, and executive risk reporting; Manage the administrative security queue and design frictionless ticketing workflows and SLAs for access reviews, SaaS evaluations, and policy exceptions; Collaborate with IT, Enterprise Security Engineering, and Product Development to align GRC policies with technical architectures and AI governance frameworks; Design and deliver security awareness and compliance training programs

Requirements

7+ years of dedicated experience in Cybersecurity GRC, IT Auditing, or Information Security Compliance, with at least 2+ years leading programs or managing teams in regulated environments (such as Healthcare or Digital Health); Direct, hands-on experience managing and maintaining at least one of the major security and healthcare frameworks, specifically HITRUST CSF, HIPAA, and SOC 2; Proven track record of leveraging modern SaaS GRC automation platforms (such as Vanta or Drata) to scale continuous compliance programs; Outstanding client-facing communication skills with a track record of partnering with Sales/CS teams to navigate complex enterprise security evaluations, vendor questionnaires, and RFP processes; Successfully designed and implemented repeatable AI-enabled workflows that address team bottlenecks and improve efficiency; Ability to operate in gray areas, finding the right balance between corporate risk tolerance, operational efficiency, and regulatory requirements; Strong cross-functional leadership skills with the ability to influence technical and non-technical business partners to align on security compliance objectives.

Nice to have

You put people first and take care of yourself, your peers, and our patients equally; You have a strong sense of ownership and take initiative while empowering others to do the same; You prioritize positive impact over busy work; You have no ego and understand that everyone has something to bring to the table regardless of experience; You appreciate transparency and promote trust and empowerment through open access of information; You are evidence-based and prioritize data and science over seniority or dogma; You take risks and rapidly iterate