jobapplier

Governance, Risk & Compliance Manager

Fullscript

Skills

Required

  • HITRUST
  • ISO 27001
  • security frameworks
  • CSF
  • CIS Controls
  • project management
  • PCI DSS
  • HIPAA

Preferred

  • GRC
  • leading external audits
  • CISSP
  • CISA
  • CRISC
  • CISM
  • CCSFP / PCI ISA/QSA
  • Vanta

Join Fullscript as a Governance, Risk & Compliance (GRC) Manager. In this hands-on leadership role, you will drive our governance, risk, and compliance strategy while managing a team of two GRC professionals. You will own our security compliance program across multiple frameworks, lead internal and external audits, and partner closely with various teams to translate regulatory and customer requirements into practical security practices. This role is ideal for someone who enjoys balancing strategic program ownership with day-to-day execution in a fast-growing SaaS environment.

Responsibilities

  • Lead and mature Fullscript's security compliance program, ensuring continuous audit readiness across multiple frameworks.
  • Manage a team of GRC professionals, providing hands-on leadership and fostering a culture of accountability and continuous improvement.
  • Coordinate and lead internal and external audits, partnering closely with various departments to translate regulatory requirements into practical security practices.
  • Hands-on experience owning enterprise compliance programs within SaaS or healthcare technology organizations
  • Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders
  • Experience managing control evidence, remediation programs, and continuous compliance activities
  • SOC 2 Type II

Requirements

  • Previous people management experience leading small, high-performing teams
  • Strong understanding of security frameworks including NIST CSF, CIS Controls, ISO 27001, and HITRUST
  • Strong project management and organizational skills with the ability to manage competing priorities
  • HITRUST
  • Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives
  • PCI DSS

Familiarity with HIPAA and its requirements

  • Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance
  • 7+ years of experience in Governance, Risk & Compliance, Information Security, IT Audit, or Security Compliance

Preferred

  • Demonstrated success leading external audits for:

Healthcare or health technology experience

  • Professional certifications such as CISSP, CISA, CRISC, CISM, HITRUST CCSFP, PCI ISA/QSA, or ISO 27001 Lead Auditor
  • Experience with GRC platforms such as Vanta, Drata, OneTrust, or similar
  • Experience supporting customer security reviews and enterprise sales due diligence