The Role Lead and mature the enterprise GRC program, managing governance, risk, compliance frameworks, audits, customer assurance, third-party risk, access compliance, and executive reporting. Administer GRC platforms, oversee HITRUST, HIPAA, and

ISO 27001

readiness, support contractual security reviews, and partner across Security, Engineering, Legal, Sales, and Customer Success. Build scalable processes, develop the GRC function, manage assessors, and improve security trust and operational maturity. Summary Generated by Built In Opportunity Overview We're looking for an experienced Lead Governance, Risk and Compliance (GRC) Manager to lead and mature our enterprise security governance, risk management, regulatory compliance, and customer assurance programs. In this role, you will drive operational excellence across compliance frameworks, security risk management, third-party assurance, and customer-facing security initiatives while strengthening the processes and technology that support our growing business. This is a hands-on leadership role suited for an experienced GRC professional who can independently manage complex initiatives, influence cross-functional stakeholders, and build scalable, repeatable operations. You'll work closely with Security, Engineering, IT, Legal, Sales, Customer Success, and executive leadership to advance our security posture, accelerate customer trust, and enable business growth. What you'll do: Lead and mature Cohere's GRC program, establishing scalable governance processes, operating procedures, risk management practices, and measurable performance indicators aligned with business objectives. Own the deployment, configuration, and optimization of enterprise GRC platforms, including control mapping, evidence automation, risk registers, continuous monitoring, and compliance reporting. Direct compliance and certification initiatives across

HITRUST, HIPAA, ISO

27001, and applicable regulatory requirements, ensuring ongoing audit readiness and effective control execution. Lead customer security assurance activities, including security questionnaires, due diligence requests, customer audits, executive briefings, and security discussions with prospective and existing clients. Partner with Sales, Customer Success, and Marketing to develop security-focused go-to-market materials, establish and maintain a customer-facing Trust Center, and strengthen security as a competitive differentiator. Review and negotiate security-related contractual requirements in partnership with Legal, including Data Protection Agreements (DPAs), Business Associate Agreements (BAAs), security exhibits, and customer security obligations. Oversee enterprise risk management activities, including risk assessments, remediation tracking, exception management, and the enforcement and reporting of vulnerability remediation SLAs across Engineering, Platform, DevOps, and Data teams. Govern identity and access compliance, including periodic access reviews, privileged access certifications, segregation of duties, and remediation of access control deficiencies. Establish and maintain cross-functional GRC engagement with business units to align security policies, controls, risk ownership, and compliance obligations with operational priorities. Develop and deliver executive-level presentations, dashboards, and reporting that communicate compliance posture, risk exposure, remediation performance, customer assurance metrics, and program maturity. Build and scale a high-performing GRC function, establishing repeatable processes, developing team capabilities, managing external assessors and partners, and driving continuous improvement with minimal day-to-day oversight. What you'll need: 8+ years of progressive experience in information security, governance, risk management, compliance, or IT audit, including 2+ years leading GRC initiatives, programs, and/or teams. Professional certifications such as CISM, CISSP, CRISC, CISA, CGRC, or

HITRUST CCSFP.

Deep working knowledge of

HITRUST, ISO

27001, and HIPAA including direct experience managing assessments, implementing controls, coordinating audits, and maintaining certification readiness. Demonstrated experience deploying and administering enterprise GRC platforms, including implementation, workflow design, control mapping, evidence collection, reporting, and process automation. Familiarity with the NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO 27017, ISO 27018, ISO 42001, and privacy-related security requirements. Deep understanding of enterprise risk management, including risk registers, control assessments, risk treatment plans, vulnerability remediation SLAs, and formal exception management. Demonstrated project and program management capabilities, including managing concurrent initiatives, developing operational roadmaps, establishing KPIs, and delivering results independently. Proven experience leading customer assurance programs, including security questionnaires, customer-facing security meetings, due diligence reviews, and responding to enterprise customer requirements. Experience with GRC platforms such as Vanta, Anecdotes, ZenGRC, Drata, ServiceNow GRC, or similar enterprise solutions. Demonstrated success developing GRC program maturity models, executive scorecards, and risk-based reporting frameworks. Excellent written and verbal communication, executive presentation, and analytical reporting skills, with the ability to translate complex security and compliance requirements into actionable business insights. Working knowledge of contractual security requirements, including reviewing and redlining security exhibits, DPAs, BAAs, and customer agreements in collaboration with Legal. Demonstrated ability to partner with Sales, Customer Success, and business stakeholders to develop customer assurance materials, security documentation, and go-to-market enablement resources. Experience designing, launching, or administering a customer-facing Security Trust Center and associated assurance workflows. Background in healthcare technology, SaaS, AI/ML-driven organizations, or other highly regulated environments.

Pay & Perks:

💻 Fully remote opportunity with about 5% travel 🩺 Medical, dental, vision, life, disability insurance, and Employee Assistance Program 📈 401K retirement plan with company match; flexible spending and health savings account 🏝️ Flex Time Off + company holidays 👶 Up to 14 weeks of paid parental leave 🐶 Pet insurance The salary range for this position is $133,000 to $145,000 annually; as part of a total benefits package which includes health insurance, 401k and bonus. In accordance with state applicable laws, Cohere is required to provide a reasonable estimate of the compensation range for this role. Individual pay decisions are ultimately based on a number of factors, including but not limited to qualifications for the role, experience level, skillset, and internal alignment. Interview Process

•: Connect with Talent Acquisition for a Preliminary Phone Screening Meet your Hiring Manager! Case Study Cross functional interview

•Subject to change

About Cohere Health:

Cohere Health's clinical intelligence platform and agentic AI-powered solutions connect health plans' strategic goals and providers' needs, optimizing the speed, cost, and quality of care. With an enterprise approach that streamlines payer-provider decision-making across the care continuum-including policy, prior authorization, payment accuracy, and more-the company improves collaboration and reduces burden, resulting in up to 8x ROI and 94% provider satisfaction. With the acquisition of ZignaAI, we've further enhanced our platform by launching our Payment Integrity Suite, anchored by Cohere Validate™, an AI-driven clinical and coding validation solution that operates in near real-time. By unifying pre-service authorization data with post-service claims validation, we're creating a transparent healthcare ecosystem that reduces waste, improves payer-provider collaboration and patient outcomes, and ensures providers are paid promptly and accurately. Cohere Health's innovations continue to receive industry wide recognition. We've been named to the 2025 Inc. 5000 list and in the Gartner® Hype Cycle™ for U.S. Healthcare Payers (2022-2025), and ranked as a Top 5 LinkedIn™ Startup for 2023 & 2024. Backed by leading investors such as Deerfield Management, Define Ventures, Flare Capital Partners, Longitude Capital, and Polaris Partners. The Coherenauts, as we call ourselves, who succeed here are empathetic teammates who are candid, kind, caring, and embody our core values and principles. We believe that diverse, inclusive teams make the most impactful work. Cohere is deeply invested in ensuring that we have a supportive, growth-oriented environment that works for everyone. We can't wait to learn more about you and meet you at Cohere Health!

Equal Opportunity Statement:

Cohere Health is an Equal Opportunity Employer. We are committed to fostering an environment of mutual respect where equal employment opportunities are available to all. To us, it's personal. Read Full Description Skills Required 8+ years of progressive experience in information security, governance, risk management, compliance, or IT audit 2+ years leading GRC initiatives, programs, or teams Professional certification such as CISM, CISSP, CRISC, CISA, CGRC, or

HITRUST CCSFP

Direct experience managing

HITRUST, ISO

27001, and HIPAA assessments, controls, audits, and certification readiness Experience deploying and administering enterprise GRC platforms, including workflow design, control mapping, evidence collection, reporting, and automation Familiarity with NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO 27017, ISO 27018, ISO 42001, and privacy-related security requirements Strong understanding of enterprise risk management, risk registers, control assessments, risk treatment plans, vulnerability remediation SLAs, and exception management Project and program management experience, including concurrent initiatives, roadmaps, KPIs, and independent delivery Experience leading customer assurance programs, security questionnaires, customer security meetings, due diligence reviews, and enterprise customer requirements Experience with GRC platforms such as Vanta, Anecdotes, ZenGRC, Drata, ServiceNow GRC, or similar Experience developing GRC maturity models, executive scorecards, and risk-based reporting frameworks Excellent written and verbal communication, executive presentation, and analytical reporting skills Working knowledge of contractual security requirements, including security exhibits, DPAs, BAAs, and customer agreements Experience partnering with Sales, Customer Success, and business stakeholders on customer assurance and security enablement materials Experience designing, launching, or administering a customer-facing Security Trust Center Background in healthcare technology, SaaS, AI/ML-driven organizations, or other highly regulated environments What the Team is Saying Kenji Staff AI Platform Engineer Cohere's hybrid work model has worked very well for me. During my tenure, there have been extended periods of time where I've been fully remote and extended periods of time where I've been based out of our Boston office. A lot of my professional success has come from opportunities for me to meet in person with my colleagues quarterly. Kenji Staff AI Platform Engineer Cohere's hybrid work model has worked very well for me. During my tenure, there have been extended periods of time where I've been fully remote and extended periods of time where I've been based out of our Boston office. A lot of my professional success has come from opportunities for me to meet in person with my colleagues quarterly. Saranya Business Analyst II Celebrating inclusivity is one of the important factors I look for in a workplace. Reflecting upon today's current affairs, it is far more important than ever to come together as one people with humanity. Cohere celebrating Asian/Pacific American Heritage Month means a lot to all of us with diverse heritage. Emma Senior Director, Data Science & Data Management At Cohere, I've had the distinct pleasure of building a fully remote team from scratch. I've been successful because of the company's ability to establish, promote & encourage open lines of communication. Our brainstorming sessions have not only improved our processes and workflows but also helped build long standing friendships with colleagues. Brad Senior Director, Commercial Strategy Cohere culture is built on a foundation of kind, thoughtful & brilliant people who inject humanity into everything they do. They have a common thread of wanting to drive toward higher quality & more efficient healthcare. Folks are empowered to own, work cross functionally on, & derive fulfillment from high-impact projects, rapidly learn & have fun! Jayna Senior Manager, Product Design Working in the healthcare space, we know that our users are interacting with a lot of different tools every day. We care about building products that can reduce this friction, are easy to use, and have a positive impact. Margot Hendrickson Chief People Officer Joining Cohere is a great opportunity to make a positive impact in healthcare, to build and innovate in tangible, visible ways with a community of dedicated colleagues — and to have fun in the process. Rachel Rabinowitz Manager, Corporate Marketing I'm thankful to work for a company as welcoming, innovative, and mission-driven as Cohere, and for an outstanding, creative marketing team. We're truly changing healthcare for the betterment of patients everywhere, and I'm grateful to be part of what we're building. Margot Hendrickson Chief People Officer I strive to build a high-performing culture not just in terms of what we achieve, but how we achieve it. Kasey Heron Senior Manager, Talent Acquisition Cohere means to hold together firmly, and that's how we work here. We really respect and trust the insights, the intelligence and the thoughtfulness of our team members. Michelle Ford VP, Strategic Accounts Working at Cohere is not a spectator sport, it is important to jump in and get involved — your colleagues and leaders will appreciate it. Brad Smertz Director, Product Strategy and Operations Cohere's culture is built on a foundation of kind, thoughtful and brilliant individuals who inject humanity into everything they do. They have a common thread of wanting to drive toward higher quality and more efficient healthcare. From day one, folks are empowered to own, work cross functionally on, and derive fulfillment from high-impact projects, rapidly learn and grow personally and professionally — and have fun. Ben Barone Director, Machine Learning A core value at Cohere Health is to respect and trust the insights, intelligence and thoughtfulness of those we work with. Brad Smertz Director, Product Strategy and Operations From day one, folks are empowered to own, work cross functionally on, and derive fulfillment from high-impact projects, rapidly learn and grow personally and professionally — and have fun. Kenji Fujita Lead Software Engineer Cohere's hybrid work model has worked very well for me. During my tenure, there have been extended periods of time where I've been fully remote and extended periods of time where I've been based out of our Boston office. A lot of my professional success has come from leadership providing opportunities for me to safely meet in person with my colleagues on a quarterly basis. Kenji Fujita Lead Software Engineer Cohere's hybrid work model has worked very well for me. During my tenure, there have been extended periods of time where I have been fully remote and extended periods of time where I have been based out of our Boston office. Therese Gorski Director, Product Management Leadership strikes a strong balance between autonomy and support. We're empowered to focus on what matters most, with just the right level of check-ins and guidance. Sujata Patil Director of Engineering and Integration By establishing a foundation of trust first, I find that everything else — process, structure and execution — falls into place. Therese Gorski Director of Product Management My role as a product leader is to set a clear vision, establish priorities, and define how the team works, which I do in collaboration with my technical partners. Kenji Fujita Lead Software Engineer A lot of my professional success has come from leadership providing opportunities for me to safely meet in person with my colleagues on a quarterly basis. Emma Nien Senior Director of Data Management and Science During my time at Cohere, I've had the distinct pleasure of building a fully remote team from scratch. I've been successful because of the company's ability to establish, promote and encourage open lines of communication. Our team's daily brainstorming sessions have not only improved our processes and workflows but also helped build long standing friendships with our colleagues. Gigi Yuen-Reed Chief Data and AI Officer The fun thing about Cohere Health is AI touches every part of the product. Jason Ehule Senior Payer Sales Manager While at Cohere Health, I have the unique opportunity to work alongside our leadership team to help define and implement strategic engagement initiatives that use cutting-edge technology. I'm fortunate to work for a company that is focused on helping unblock a broken healthcare system by removing barriers to entry and simplifying the process for patients and physicians. Cohere Health Compensation & Benefits Highlights Leave & Time Off Breadth — Leave policies include up to 184 hours (23 days) of PTO annually plus 10 company holidays, with additional recharge days also noted. This breadth of time off is consistently highlighted as a standout element of the package. Parental & Family Support — Paid parental leave is advertised at up to 14 weeks, offering substantial support for growing families. This level of leave is positioned as a meaningful advantage relative to many employers. Healthcare Strength — Medical, dental, vision, life and disability coverage are provided alongside HSA/FSA options and EAP resources. Multiple plan options and first‑day eligibility mentions indicate broad healthcare support. Learn more about Cohere Health's Compensation & Benefits → Cohere Health Insights What's It Like to Work at Cohere Health? Cohere Health Culture & Values Cohere Health Career Growth & Development What's the Work-Life Balance Like at Cohere Health? Cohere Health Leadership & Management Cohere Health Company Growth, Stability & Outlook View all jobs at Cohere Health View Cohere Health Profile Report Job