Garner Health - Sr. GRC Analyst - Internal Governance

• This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week. • Own Garner’s annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting • Manage risk exceptions and prepare risk acceptances for leadership decision • Run third party and vendor risk reviews from intake through approval and periodic reassessment • Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision • Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking • Manage the maintenance of our compliance policies, standards, and procedures • Report on our compliance posture to senior leadership • Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest • 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance • Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005 • Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment • Working knowledge of HIPAA and of SOC 2, ISO 27001, and HITRUST requirements • A track record of driving accountability across teams you don’t manage, and the ability to adapt your communication style across engineers, operators, and executives • A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks • A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback • Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred • Technologies we use: • AWS, Okta, Wiz, Retool, Gitlab, Vanta, Claude • Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time.