Security Engineer II (GRC), Remote

Aledade is a public benefit corporation focused on empowering independent primary care. They are seeking a Security Engineer II (GRC) to design, implement, and maintain governance, risk, and compliance processes while collaborating with various teams to ensure adherence to healthcare security standards.

Responsibilities:

• Design, implement, and maintain robust governance, risk, and compliance processes, ensuring adherence to healthcare security standards including HIPAA, HITRUST, and SOC2
• Collaborate cross-functionally with various teams to align GRC solutions with organizational security requirements, facilitating compliant and efficient operations across the enterprise
• Drive impactful compliance outcomes that directly strengthen our regulatory posture and support our critical security attestation initiatives
• Working cross-functionally to design, build, and operate GRC solutions that improve and mature our compliance capabilities
• Implement and optimize security questionnaire and trust assessment workflows
• Develop automated compliance monitoring and reporting mechanisms
• Design scalable GRC processes that support business growth
• Leveraging data and risk analytics to understand compliance trends, metrics, and opportunities to improve our security posture, researching regulatory requirements, and then making recommendations to address compliance gaps with stakeholders
• Analyze security assessment results and third-party risk evaluations
• Track and report on key risk indicators and compliance metrics
• Research emerging GRC requirements and industry best practices
• Supporting and enhancing incident/issues response efforts from a compliance perspective, contributing to analysis, containment, and mitigation strategies in a cross-functional environment to ensure effective resolution and regulatory adherence
• Assess compliance implications of security incidents
• Support breach notification and regulatory reporting requirements
• Coordinate with legal and compliance teams on incident response
• Helping craft and refine GRC documentation pertinent to our Security Program, such as policies, standards, risk assessments, and compliance procedures
• Maintain security questionnaire response repository and knowledge base
• Develop and update GRC policies, procedures, and control documentation
• Create compliance training materials and guidance documents

Requirements:

• BS / BTech (or higher) in Computer Science, Information Technology, Cybersecurity or a related field
• 2+ years combined experience as a security or GRC professional in an enterprise environment (preferably healthcare or highly regulated industry)
• Experience in Governance, Risk, and Compliance functions, including hands-on experience with GRC frameworks (SOC2, HIPAA, HITRUST, NIST)
• Knowledge of GRC frameworks and regulations (SOC 2, HIPAA, SOX/ITGC, HITRUST, CPRA, NIST, ISO 27001)
• Skilled in leveraging GRC platforms (e.g., Vanta, OneTrust) to automate compliance and streamline controls monitoring