Senior GRC Analyst – Internal Governance

Garner Health

. Own Garner’s annual information security risk assessment and risk register, including risk identification, scoring, treatment, and reporting .

Posted 11/4/2026full-timeRemote • United StatesSenior💰 $155,000 - $185,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in information security risk management, including risk assessment, compliance with HIPAA and SOC 2, and vendor risk management. Proficient in leveraging automation and AI to enhance GRC functions and improve operational efficiency.

Highest-signal resume keywords

GRC ManagementInformation Security Risk AssessmentVendor Risk ManagementHIPAA ComplianceAutomation Using Scripting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk IdentificationRisk ScoringRisk TreatmentVulnerability ScanningPenetration TestingCompliance ReportingNIST CSFISO 27005Cloud-Native EngineeringFindings Remediation

Soft Skills

Adaptable CommunicationAccountability Across Teams

Tools & Technologies

GRC ToolsAutomation ToolsLLMs

Certifications & Qualifications

CISACISMCISSPCRISCISO 27001 Lead Auditor

Industry Keywords

IT Risk ManagementThird Party Risk ManagementCompliance PoliciesSOC 2ISO 27001HITRUST

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Own Garner’s annual information security risk assessment and risk register, including risk identification, scoring, treatment, and reporting
Manage risk exceptions and prepare risk acceptances for leadership decision
Run third-party and vendor risk reviews from intake through approval and periodic reassessment
Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents
Track remediation with Engineering, enforce SLAs, and escalate findings requiring a risk decision
Run the security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking
Maintain compliance policies, standards, and procedures
Report compliance posture to senior leadership
Scale the GRC function with AI and automation, building quick wins and scoping requirements for Engineering

Requirements

What you’ll need

5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance
Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005
Hands-on experience with vendor risk management and vulnerability or findings remediation programs in a cloud-native engineering environment
Working knowledge of HIPAA and SOC 2, ISO 27001, and HITRUST requirements
Track record of driving accountability across teams without direct management authority
Ability to adapt communication style across engineers, operators, and executives
Prior experience using scripting and LLMs to automate repetitive tasks
Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred
Must be unable to require employer sponsorship or takeover of sponsorship for an employment visa

Benefits

Comp & perks

Equity incentive plan
Flexible PTO
Medical/Dental/Vision plan options
401(k) with company match
Flexible spending accounts
Teladoc Health
Accommodations for qualified individuals with disabilities in the recruiting process