The Role Own the information security risk register, risk assessments, vendor risk reviews, risk exceptions, security findings remediation, compliance training, policies, and governance reporting. Partner with engineering and company leaders to enforce remediation and strengthen the control environment. Scale GRC through AI, scripting, and automation while supporting

HIPAA, SOC 2, ISO

27001, and HITRUST compliance. Summary Generated by Built In What you'll be part of Garner is on a mission to transform the U.S. healthcare system — and we're the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster. The result is a rare "win win" — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can.

About the role:

We are looking for a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner's security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program. You will partner with all departments across the company so that risks are identified early, decisions are made deliberately, and remediation actually gets done. Our Technology Compliance team safeguards Garner's sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow.

Where you will work:

This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week.

What you will do:

Own Garner's annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting Manage risk exceptions and prepare risk acceptances for leadership decision Run third party and vendor risk reviews from intake through approval and periodic reassessment Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking Manage the maintenance of our compliance policies, standards, and procedures Report on our compliance posture to senior leadership Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest What you will bring to the team: 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or

ISO 27005

Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment Working knowledge of HIPAA and of

SOC 2, ISO

27001, and HITRUST requirements A track record of driving accountability across teams you don't manage, and the ability to adapt your communication style across engineers, operators, and executives A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback Industry certifications such as CISA, CISM, CISSP, CRISC, or

ISO 27001

Lead Auditor preferred Technologies we use: AWS, Okta, Wiz, Retool, Gitlab, Vanta, Claude Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time.

Compensation Transparency:

The target salary range for this position is $155,000-185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k) with company match, flexible spending accounts, Teladoc Health and more.

Fraud and Security Notice:

Please be aware of recent job scam attempts. Our recruiters use getgarner.com and garnerhealth.com email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement here and to candidateprotection@garnerhealth.com.

Equal Employment Opportunity:

Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at talent@garnerhealth.com. Read Full Description Skills Required 5+ years of experience in GRC, IT risk management, third-party risk management, or information security compliance Experience conducting information security risk assessments and maintaining a risk register Experience using established risk methodologies such as NIST CSF or

ISO 27005

Hands-on vendor risk management experience Experience managing vulnerability or security findings remediation programs in a cloud-native engineering environment Working knowledge of

HIPAA, SOC 2, ISO

27001, and HITRUST requirements Ability to drive accountability across teams and communicate effectively with engineers, operators, and executives Experience using scripting and large language models to automate repetitive GRC tasks CISA, CISM, CISSP, CRISC, or

ISO 27001

Lead Auditor certification What the Team is Saying Pedro Data Science Working at Garner feels like that moment after a good dinner when the food has been cleared but people still linger at the table. Everyone is so compelled to be here, to share their ideas, and to build something together. Pedro Data Science Working at Garner feels like that moment after a good dinner when the food has been cleared but people still linger at the table. Everyone is so compelled to be here, to share their ideas, and to build something together. Joanna Sales When you're working for a fast-paced company in an environment that can be challenging, it's easy to get frustrated if you feel like things are not being done right. At Garner, we try as a company to eliminate frustrations from individuals by encouraging them to speak up and communicate courageously. Megan Concierge The team gets to have a front row seat to the direct impact of the work that we're doing at

Garner:

being able to see the weight that's lifted off of someone's shoulders. There's real value in what we're offering and real-world, live impact for folks. James Product I joined Garner for the mission - to rewire the economics of the U.S. healthcare system in a way that leaves people healthier, minus the egregious costs. Garner is filled with people who care about that mission and are doing enormously challenging work to enact it. I find that continuously energizing and exciting. Bhavya Engineering In my first month, I got to try a lot of our base infrastructure and help set the foundations of our app. That was pretty unique. Garner is more dynamic than any other company I've worked with. Chris Engineering We are in an age where every company out there has some kind of statement of what their mission is. They have all these cultural statements, because they need to say those things in order to recruit. Garner is the only place I've ever been that actually walks the talk. It's the only place where the mission really is what the company is about. Garner Health Compensation & Benefits Highlights Healthcare Strength — Health coverage is bolstered by access to the company's own reimbursement program, with up to $4,000 for individuals and $8,000 for families toward eligible care that can meaningfully lower out-of-pocket costs. Feedback suggests this feature is a standout element and is praised for reducing expenses when using eligible providers. Leave & Time Off Breadth — Time off includes flexible PTO, rest days around federal holidays, and a paid sabbatical after five years. Feedback suggests PTO is viewed positively and often cited as a strength, though usage can depend on team norms. Parental & Family Support — The company advertises 12 weeks of parental leave. Feedback suggests this is a meaningful and competitive offering for employees planning families. Learn more about Garner Health's Compensation & Benefits → Garner Health Insights What's It Like to Work at Garner Health? Garner Health Culture & Values Garner Health Career Growth & Development What's the Work-Life Balance Like at Garner Health? Garner Health Leadership & Management Garner Health Company Growth, Stability & Outlook View all jobs at Garner Health View Garner Health Profile Report Job