GRC Analyst

Ceresti Health

4d • Remote

About The Position

Ceresti is seeking an early-career GRC Analyst to document and demonstrate the effectiveness of its security and privacy controls, supporting the company's SOC 2, HITRUST, and HIPAA obligations. The analyst will gather audit-ready evidence, maintain policies, assess vendors, and support the privacy and data program.

Reporting to the Chief Information Security Officer, this role works across Security, IT, Engineering, and Operations. It focuses on governance and evidence rather than operating and monitoring security controls. The position offers broad exposure to the security program at a regulated healthcare technology company.

Requirements

• One to three years of experience in governance, risk and compliance, audit, or a related field.
• Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and willingness to learn the others quickly.
• Clear, precise writing.
• Attention to detail and patience in tracking many small items through to completion.
• Comfort following up with colleagues for evidence without being pushy.

Nice To Haves

• Exposure to a GRC or compliance-automation platform.
• Experience in healthcare or another regulated industry.
• Familiarity with vendor risk assessments or BAA tracking.
• External audit exposure.

Responsibilities

• Collect evidence for SOC 2 Type 2 and HITRUST, including internal audit testing of controls.
• Track control evidence status and keep the CISO informed.
• Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts.
• Update security and privacy policies, manage versions, and track employee read acknowledgments.
• Maintain documented proof that policies are being followed across the company.
• Conduct third-party vendor risk assessments, document findings, and escalate items requiring a decision.
• Support HIPAA and other healthcare compliance obligations alongside the CISO.
• Support the data retention, de-identification, and disposal program.
• Support the Privacy and Data Program.

Benefits

• Competitive base salary, with the final offer based on experience, skills, and location.
• Comprehensive health, dental, and vision benefits.
• Equity participation in a growing healthcare technology company.
• PTO and a culture that respects it.
• A collaborative, mission-driven environment where work supports family caregivers and improves outcomes for people living with dementia.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Education Level: No Education Listed