GRC Analyst

About This Role

This governance, risk, and compliance role focuses on turning the security team's daily work into documented, audit-ready evidence for SOC 2, HITRUST, and HIPAA obligations. Reporting to the Chief Information Security Officer, you will work across Security, IT, Engineering, and Operations, gathering evidence, keeping policies current, assessing vendors, and supporting the privacy and data program. This position is suited for someone early in their career who is organized, writes clearly, and is eager to learn how a regulated healthcare company earns and maintains its certifications.

Responsibilities

• Collect evidence for SOC 2 Type 2 and HITRUST, including internal audit testing of controls
• Track control evidence status and keep the CISO informed
• Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts
• Update security and privacy policies, manage versions, and track acknowledgements
• Maintain documented proof that policies are being followed across the company
• Run third-party vendor risk assessments, document findings, and escalate issues that require a decision
• Support HIPAA and other healthcare compliance obligations alongside the CISO
• Support the data retention, de-identification, and disposal program
• Support the Privacy and Data Program

Requirements

• One to three years of experience in governance, risk and compliance, audit, or a related field
• Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and the appetite to learn the others quickly
• Clear, precise writing, as much of this role involves producing documents other people depend on
• Attention to detail, and the patience to track many small items to completion
• Comfort following up with colleagues for evidence without being pushy

Nice to have:

• Exposure to a GRC or compliance-automation platform
• Experience in healthcare or another regulated industry
• Familiarity with vendor risk assessments or BAA tracking
• External audit exposure

Benefits

• Comprehensive health, dental, and vision benefits
• Equity participation in a growing healthcare technology company
• PTO and a culture that respects it
• A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia

Important Details

• Work format: full-time remote

About the Company

Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. It is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. The company offers health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs. Its culture is rooted in agility, innovation, and collaboration.