Director of Security, GRC (Remote)

Aledade

143d • Remote

About The Position

Aledade is seeking a Director of Governance, Risk & Compliance (GRC) to lead and scale our enterprise GRC program. Reporting directly to the Chief Information Security Officer (CISO), this role is responsible for building out a cohesive framework for risk management, compliance, and certifications while ensuring that security, privacy, and governance practices align with regulatory, contractual, and audit expectations.

The Director will manage a growing team (currently two direct reports) and own Aledade’s risk program, GRC platforms (including Vanta), and policy framework. This leader will be accountable for driving compliance certifications (SOC 2, HIPAA, SOX/ITGC, HITRUST, CPRA), partnering across Security, IT, Product, and Legal to ensure evidence is ready for external audits, and ensuring governance enables both innovation and protection of sensitive patient data.

Requirements

• 10+ years of experience in Governance, Risk, and Compliance, Information Security, or related fields, with at least 5 years in leadership roles.
• Strong knowledge of risk management frameworks and regulatory requirements, including SOC 2, HIPAA, SOX/ITGC, HITRUST, and CPRA.
• Demonstrated experience preparing organizations for external audits and regulatory certifications.
• Hands-on experience with GRC platforms (e.g., Vanta, OneTrust, Archer, or similar).
• Proven ability to design and operationalize compliance programs, policies, and evidence frameworks at scale.
• Excellent leadership, communication, and cross-functional collaboration skills.

Nice To Haves

• Deep knowledge of GRC frameworks and regulations (SOC 2, HIPAA, SOX/ITGC, HITRUST, CPRA, NIST, ISO 27001).
• Strong program management and audit readiness skills, including policy development, evidence collection, and external audit coordination.
• Skilled in leveraging GRC platforms (e.g., Vanta, OneTrust) to automate compliance and streamline controls monitoring.
• Proven leadership and people development abilities, with experience growing and mentoring high-performing teams.
• Excellent collaboration and communication skills, with the ability to influence executives, engineers, and auditors.
• Ability to balance compliance requirements with innovation, translating regulations into scalable, practical processes.
• CISA, CISM, CRISC, or CISSP certifications.

Responsibilities

• Build, lead, and continuously mature Aledade’s Governance, Risk & Compliance program.
• Own and maintain the enterprise risk management framework and risk registry, facilitating reviews and reporting to leadership and the Audit Committee.
• Lead Aledade’s compliance certification programs, including SOC 2, HIPAA, SOX/ITGC, HITRUST, and CPRA.
• Manage audit preparedness and execution for external assessments, ensuring evidence collection and readiness across business and technology teams.
• Oversee the Vanta Trust platform, including continuous control monitoring, automation of evidence gathering, and Trust Center management.
• Develop and enforce policies and standards, ensuring clarity, adoption, and alignment with frameworks such as NIST, ISO 27001, HIPAA, and AI RMF.

Benefits

• Flexible work schedules and the ability to work remotely are available for many roles
• Health, dental and vision insurance paid up to 80% for employees, dependents and domestic partners
• Robust time-off plan (21 days of PTO in your first year)
• Two paid volunteer days and 11 paid holidays
• 12 weeks paid parental leave for all new parents
• Six weeks paid sabbatical after six years of service
• Educational Assistant Program and Clinical Employee Reimbursement Program
• 401(k) with up to 4% match
• Stock options

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed
• Number of Employees: 1,001-5,000 employees