SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 155,000 - 185,000 / annual
Garner Health is transforming the U.S. healthcare system by partnering with employers to redesign healthcare delivery. The company uses 550+ proprietary clinical metrics across 80+ specialties to identify best-performing doctors and steer members to higher-quality care, resulting in better outcomes and lower costs. Garner has helped 2.5 million people access better care and saved $1B in healthcare costs in five years.
As a Senior GRC Analyst on the Technical Compliance team, you will be responsible for ensuring Garner's compliance posture across security frameworks including ISO 27001, SOC 2, HITRUST, and HIPAA. You will manage internal audits, guide external assessments, and partner with Engineering, Product, People, and Legal teams to ensure controls are well-designed, operating effectively, and continuously improving. Your work directly impacts Garner's ability to win and retain enterprise customers, expand into new business lines, and scale securely.
Key responsibilities include:
- Manage and support compliance certifications (SOC 2, HITRUST, ISO 27001) and run control testing across audit lifecycles
- Serve as subject matter expert on compliance frameworks across the company
- Act as primary point of contact for external auditors and assessors
- Manage Garner's Security and Privacy trust center
- Maintain risk register and drive risk identification, scoring, and reporting
- Manage compliance policies, standards, and procedures
- Report compliance posture to senior leadership
- Scale GRC function using AI and automation, identifying quick wins and scoping requirements for Engineering
The role is remote across the U.S., with a hybrid option (Tuesday-Thursday in-office) available for NYC-based candidates.
Technologies used: AWS, Okta, Datadog, Retool, Gitlab, Vanta, Claude.
REQUIREMENTS:
- 5+ years of experience in GRC, IT audit, or information security compliance
- Prior experience with HITRUST, SOC 2, and ISO 27001 audits
- Hands-on experience with control design, evidence collection, and remediation in cloud-native engineering environments
- Proven ability to adapt communication style across engineers, operators, and executives
- GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks
- Industry certifications preferred: CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor
- Desire to be part of a high-performing, mission-driven team operating with intense urgency and strong accountability
Note: The company is unable to sponsor or take over sponsorship of employment visas at this time.
