Lead Governance, Risk and Compliance Manager

Leads the governance, risk and compliance programme at Cohere Health, a healthcare technology company, in a hands-on role within the Security department. The manager is responsible for enterprise security governance, risk management, regulatory compliance and customer assurance, working with Security, Engineering, IT, Legal, Sales and executive leadership, and builds out the GRC function as it grows.

The work spans HITRUST, HIPAA and ISO 27001 certification and audit readiness, and the deployment of enterprise GRC platforms for control mapping, evidence automation, risk registers and continuous monitoring. The role also runs customer assurance, from security questionnaires and audits to a customer-facing Trust Center, and reviews security terms in DPAs and BAAs alongside Legal. Risk assessments, exception management, vulnerability remediation SLAs and identity compliance, such as access reviews and segregation of duties, fall under it as well, along with dashboards and presentations for executives and the management of external assessors.

The company asks for eight or more years in information security, risk, compliance or IT audit, with at least two leading GRC initiatives or teams, and certifications such as CISM, CISSP, CRISC, CISA or HITRUST CCSFP. Direct experience with HITRUST, ISO 27001 and HIPAA assessments and with platforms such as Vanta, Drata or ServiceNow GRC is expected, as is a background in a regulated field such as healthcare technology or SaaS. The role is fully remote with about 5% travel.