GRC Analyst – Remote

About the role

Ceresti is seeking a GRC Analyst to turn daily security activities into documented, audit‑ready evidence for SOC 2, HITRUST, and HIPAA compliance. Reporting to the CISO, you will work across Security, IT, Engineering, and Operations to gather evidence, maintain policies, assess vendors, and support the privacy program.

Key responsibilities

• Collect and track audit evidence for SOC 2 Type 2 and HITRUST, coordinating with control owners.
• Update and version‑control security and privacy policies, ensuring employee acknowledgment.
• Run third‑party vendor risk assessments, document findings, and escalate decisions.
• Support HIPAA compliance, data retention, de‑identification, and disposal processes.

Required profile

• 1‑3 years of experience in governance, risk, compliance, audit, or a related field.
• Working knowledge of at least one framework (SOC 2, HITRUST, or HIPAA) with a willingness to learn the others.
• Clear, precise writing and strong attention to detail.
• Ability to follow up with colleagues for evidence without being pushy.

Required skills

• Familiarity with SOC 2, HITRUST, or HIPAA compliance requirements.
• Experience with GRC or compliance‑automation platforms (preferred).
• Vendor risk assessment and BAA tracking experience (preferred).

What we offer

• Full‑time remote work.
• Competitive base salary based on experience, skills, and location.
• Comprehensive health, dental, and vision benefits.
• Equity participation in a growing healthcare technology company.
• PTO and a culture that respects it.
• A collaborative, mission‑driven environment supporting family caregivers.