Lead Governance, Risk and Compliance Manager

Cohere Health

6d • $133,000 - $145,000 • Remote

About The Position

Cohere Health is seeking an experienced Lead Governance, Risk and Compliance (GRC) Manager to lead and mature its enterprise security governance, risk management, regulatory compliance, and customer assurance programs. This hands-on leadership role is responsible for strengthening the processes and technology supporting a growing business, advancing security posture, building customer trust, and enabling business growth. The manager will work with Security, Engineering, IT, Legal, Sales, Customer Success, and executive leadership, managing complex initiatives and building scalable, repeatable operations with minimal day-to-day oversight.

The role leads the GRC program and enterprise risk activities; deploys and optimizes GRC platforms; directs compliance and certification initiatives; and manages customer security assurance, including questionnaires, due diligence, audits, executive briefings, and security discussions. It also partners with commercial teams on customer-facing security materials and a Trust Center, collaborates with Legal on security-related contractual requirements, governs identity and access compliance, and provides executive reporting on compliance posture, risk, remediation, customer assurance, and program maturity. The role builds the GRC function, develops team capabilities, manages external assessors and partners, and drives continuous improvement.

Cohere Health describes its clinical intelligence platform and agentic AI-powered solutions as connecting health plans’ strategic goals with providers’ needs to improve the speed, cost, and quality of care. The company says it is committed to a supportive, growth-oriented and inclusive environment.

Requirements

• At least 8 years of progressive experience in information security, governance, risk management, compliance, or IT audit, including at least 2 years leading GRC initiatives, programs, and/or teams.
• Professional certification such as CISM, CISSP, CRISC, CISA, CGRC, or HITRUST CCSFP.
• Deep working knowledge of HITRUST, ISO 27001, and HIPAA, including direct experience managing assessments, implementing controls, coordinating audits, and maintaining certification readiness.
• Experience deploying and administering enterprise GRC platforms, including implementation, workflow design, control mapping, evidence collection, reporting, and process automation.
• Familiarity with the NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO 27017, ISO 27018, ISO 42001, and privacy-related security requirements.
• Deep understanding of enterprise risk management, including risk registers, control assessments, risk treatment plans, vulnerability remediation SLAs, and formal exception management.
• Project and program management capabilities, including managing concurrent initiatives, developing operational roadmaps, establishing KPIs, and delivering results independently.
• Experience leading customer assurance programs, including security questionnaires, customer-facing security meetings, due diligence reviews, and responses to enterprise customer requirements.
• Experience with GRC platforms such as Vanta, Anecdotes, ZenGRC, Drata, ServiceNow GRC, or similar enterprise solutions.
• Success developing GRC program maturity models, executive scorecards, and risk-based reporting frameworks.
• Excellent written and verbal communication, executive presentation, and analytical reporting skills, with the ability to translate complex security and compliance requirements into actionable business insights.
• Working knowledge of contractual security requirements, including reviewing and redlining security exhibits, DPAs, BAAs, and customer agreements in collaboration with Legal.
• Ability to partner with Sales, Customer Success, and business stakeholders to develop customer assurance materials, security documentation, and go-to-market enablement resources.
• Experience designing, launching, or administering a customer-facing Security Trust Center and associated assurance workflows.

Nice To Haves

• Background in healthcare technology, SaaS, AI/ML-driven organizations, or other highly regulated environments.

Responsibilities

• Lead and mature the GRC program, establishing scalable governance processes, operating procedures, risk management practices, and measurable performance indicators aligned with business objectives.
• Own the deployment, configuration, and optimization of enterprise GRC platforms, including control mapping, evidence automation, risk registers, continuous monitoring, and compliance reporting.
• Direct compliance and certification initiatives across HITRUST, HIPAA, ISO 27001, and applicable regulatory requirements, maintaining audit readiness and effective control execution.
• Lead customer security assurance activities, including security questionnaires, due diligence requests, customer audits, executive briefings, and security discussions with prospective and existing clients.
• Partner with Sales, Customer Success, and Marketing to develop security-focused go-to-market materials, maintain a customer-facing Trust Center, and strengthen security as a competitive differentiator.
• Review and negotiate security-related contractual requirements with Legal, including DPAs, BAAs, security exhibits, and customer security obligations.
• Oversee enterprise risk management, including risk assessments, remediation tracking, exception management, and vulnerability remediation SLAs across Engineering, Platform, DevOps, and Data teams.
• Govern identity and access compliance, including periodic access reviews, privileged access certifications, segregation of duties, and remediation of access control deficiencies.
• Establish cross-functional GRC engagement with business units to align security policies, controls, risk ownership, and compliance obligations with operational priorities.
• Develop executive presentations, dashboards, and reporting on compliance posture, risk exposure, remediation performance, customer assurance metrics, and program maturity.
• Build and scale the GRC function by establishing repeatable processes, developing team capabilities, managing external assessors and partners, and driving continuous improvement.

Benefits

• Fully remote opportunity with about 5% travel.
• Medical, dental, vision, life, and disability insurance, and an Employee Assistance Program.
• 401(k) retirement plan with company match.
• Flexible spending and health savings accounts.
• Flex Time Off and company holidays.
• Up to 14 weeks of paid parental leave.
• Pet insurance.
• Bonus included as part of the total benefits package.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed