GRC/IT Compliance Analyst

About the Opportunity

Our Information Security team is growing, and we have an immediate opening for a GRC and IT Compliance Analyst to help support and execute Cleerly’s security and compliance objectives. Reporting to the Director of Information Security, this role will be a multi-faceted specialist function that focuses on GRC, IT compliance, and risk management, as well as executing on core security-related audits and control assessments. The ideal candidate is a self-motivated individual who is great at task and time management and is willing to learn and adapt to changing regulatory environments.

Responsibilities

You will work closely with our Information Security leadership and cross-functional teams to drive GRC initiatives and ensure the continuous monitoring of security controls. On any given day, you will be:

Build and implement a new enterprise risk assessment platform to streamline compliance workflows;

Continuously monitor and update the risk platform to reflect evolving threats and regulatory requirements;

Participate in risk analysis and features development processes to proactively identify risks to our regulated products;

Continuously monitor and evaluate internal controls for areas of improvement;

Conduct user access reviews to applications and services;

Periodically review policies and procedures for compliance with best practices and compliance frameworks;

Assist in owning and drafting documents for FDA regulatory submissions.

Requirements

5-7 years of experience in security or compliance analysis, IT risk assessment, risk management, or assurance/advisory experience over IT/IS general controls;

BS degree in Management Information Systems, Computer Science, Accounting with ITGC experience, Engineering, Cybersecurity, Bio-Medical Engineering, or a related field;

Experience with GRC software implementation;

Experience with FDA regulatory submissions and SaMD (Software as a Medical Device) regulations;

Proven experience in enterprise risk management (ERM) frameworks, risk identification, and qualitative/quantitative risk assessment methodologies;

Previous experience working within a startup environment;

Experience with Agile/Scrum environments and integrating security/compliance into the SDLC;

Strong understanding of internal controls necessary to meet compliance frameworks such as ISO 27001, HITRUST, and SOC 2;

Excellent verbal and written communication skill sets for addressing security concerns from internal stakeholders within the company.

Impress us more

CISA, CISM, CISSP, CRISC, or related certifications;

Experience in the digital healthcare industry;

Experience with open-source GRC tooling such as CISO Advisor or Eramba is a plus.

Compensation

The base salary range for this role varies by location and is aligned to market benchmarks.

Candidates located in higher-cost labor markets, including California, Washington, New York, New Jersey, Connecticut, Massachusetts, and Washington, DC represent the middle to high end of the range, while candidates located in all other U.S. locations represent the low to middle end of the range.

Final compensation is determined based on location, experience, skills, and internal equity.

This role is eligible for a XX% target annual bonus, resulting in the following base salary and Total Target Compensation (TTC) ranges:

Base Salary: $108,000 - $130,000

TTC: $118,800 - $143,000

*Total Target Compensation (TTC): Total Cash Compensation (including base pay, variable pay, commission, bonuses, etc.) Additionally, stock options, paid benefits, and employee perks are part of your total rewards.