Sr. GRC Analyst - Internal Governance

Location: Remote across the U.S.; New York City candidates must work in the office Tuesday, Wednesday, and Thursday each week.

Target salary: $155,000–$185,000 per year, plus equity eligibility and benefits.

Company

hirify.global transforms the U.S. healthcare system by using clinical metrics, healthcare data, incentives, and AI to help members access higher-quality care while reducing costs.

What you will do

• Own the annual information security risk assessment and risk register, including risk identification, scoring, treatment, and reporting.
• Manage risk exceptions, risk acceptances, and third-party/vendor risk reviews from intake through approval and reassessment.
• Track security findings from vulnerability scans, penetration tests, audits, client assessments, and incidents through remediation with Engineering; enforce SLAs and escalate decisions when needed.
• Run annual security awareness and HIPAA training, onboarding, content updates, and completion tracking.
• Maintain compliance policies, standards, and procedures and report the compliance posture to senior leadership.
• Scale GRC through AI and automation by developing quick wins and defining requirements for Engineering automation.

Requirements

• 5+ years of experience in GRC, IT risk management, third-party risk management, or information security compliance.
• Experience conducting information security risk assessments and maintaining a risk register using methodologies such as NIST CSF or ISO 27005.
• Hands-on experience with vendor risk management and vulnerability or findings remediation programs in a cloud-native engineering environment.
• Working knowledge of HIPAA, SOC 2, ISO 27001, and HITRUST requirements.
• Ability to drive accountability across teams without direct management responsibility and adapt communication for engineers, operators, and executives.
• Prior experience using scripting and LLMs to automate repetitive GRC tasks.
• Ability to work in a high-performing, mission-driven environment with urgency, individual accountability, and authentic feedback.
• Technologies used include AWS, Okta, Wiz, Retool, GitLab, Vanta, and Claude.
• Garner cannot sponsor or take over sponsorship of an employment visa.

Nice to have

• Certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor.

Culture & Benefits

• Mission-driven work focused on improving healthcare quality and reducing costs.
• Strong individual accountability, intense urgency, and a commitment to authentic feedback.
• Flexible PTO and medical, dental, and vision plan options.
• 401(k) with company match, flexible spending accounts, Teladoc Health, and other competitive benefits.
• Eligibility to participate in an equity incentive plan.