Security GRC Manager

The posting, as Rightway wrote it

ABOUT THE ROLE

Join Rightway as a Security GRC Manager, a role that owns and matures our GRC function. You will enhance our policies and procedures, streamline workflows, mature our risk management program, own our integrated SOC 2 + HITRUST attestation as we scale, and lead the GRC team.

WHAT YOU’LL DO

• Team Leadership: Lead and mentor a small GRC team, setting priorities, reviewing work, and growing the function alongside the business.
• Control Library Development: Own and evolve our unified control library, maintaining mappings across SOC 2, SOC 1, and the latest HITRUST version, and addressing gaps or inefficiencies as the organization and framework requirements change.
• Audit Ownership: In partnership with Engineering, IT, People, and Finance, lead the audit program for control requirements and evidence production, proactively in anticipation of SOC 1, SOC 2/HITRUST, and customer audits.
• Data Privacy and Protection: Partner with Legal as a key stakeholder in the Data Privacy program, including HIPAA/HITECH, BAAs, data privacy and protection impact assessments, incident/breach analysis, and data handling requirements.
• AI Governance: Own and mature the AI governance program modeled after ISO/IEC 42001, including the AI risk register, Statement of Applicability, and AI risk assessments for internal use cases. Respond to customer and partner AI governance questionnaires, and maintain alignment to emerging requirements such as the Colorado Automated Decision-Making Technology Act (ADMTA).
• Contract security and privacy review: Review and negotiate security, privacy, data protection, incident notification, audit rights, AI, and related language in customer and vendor agreements.
• Control Monitoring: Monitor, measure, and report on control effectiveness for security and compliance in Drata, maintaining continuous control monitoring and evidence collection, and adjusting strategy and implementation as needed.
• Policy Enhancement: Collaborate cross-functionally to improve policies and related procedures, boosting operational efficiency, control maturity, security, and compliance
• Business Continuity Planning: Lead business continuity planning and testing, with a focus on a Business Impact Analysis (BIA) informed program.
• Third Party Risk Management: Revamp and execute a flexible yet thorough Third Party Risk Management (TPRM) program, keeping a keen eye on data security and technical risk, not just compliance.
• Risk Management: Own the security risk management program, participating in preparation, discussion, tracking (risk register), and remediation of enterprise risks within your sphere of influence, in addition to annual risk assessments activities.
• Training Programs Development: Engage with organizational stakeholders to develop and implement effective security and compliance training programs.
• Customer Trust: Own and maintain the customer assurance program, including the security questionnaire and RFP res

[…]
rities, we are present for each other, and we strive for mutual understanding.

• We redefine what is possible

We always look beyond the obstacles in front of us to imagine new solutions. We approach our work with inspiration from other industries, other leaders, and other challenges. We use ingenuity and resourcefulness when faced with tough problems.

• We debate then commit

We believe that a spirit of open discourse is part of a healthy culture. We understand and appreciate different perspectives and we challenge our assumptions. When working toward a decision or a new solution, we actively listen to one another, approach it with a “yes, and” mentality, and assume positive intent. Once a decision is made, we align and champion it as one team.

• We cultivate grit

Changing healthcare doesn’t happen overnight. We reflect and learn from challenges and approach the future with a determination to strive for better. In the face of daunting situations, we value persistence. We embrace failure as a stepping stone to future success. On this journey, we seek to act with guts, resilience, initiative, and tenacity.

• We seek to delight

Healthcare is complicated and personal. We work tirelessly to meet the goals of our clients while also delivering the best experience to our members. We recognize that no matter the role or team, we each play a crucial part in our members’ care and take that responsibility seriously. When faced with an obstacle, we are kind, respectful, and solution-oriented in our approach. We hold ourselves accountable to our clients and our members’ success.

Rightway is proud to be an Equal Opportunity Employer that believes in the strength of diverse thought, beliefs, backgrounds, and education. We foster an inclusive culture where differences are celebrated to drive the best business decisions possible. We do not discriminate on any basis protected by applicable law. All employment decisions are based on merit, qualifications, need, and performance.