[Hiring] GRC Analyst @Ceresti Health

Role Description

Ceresti's security and privacy controls only count if we can prove they work. As GRC Analyst, you turn what the security team does every day into documented, audit-ready evidence — the record behind our SOC 2, HITRUST, and HIPAA obligations.

You will report to the Chief Information Security Officer and work across Security, IT, Engineering, and Operations: gathering evidence, keeping policies current, assessing vendors, and supporting the privacy and data program. This is the governance side of security. The Security Analyst operates and monitors the controls; you prove they are working.

This role is targeted to someone early in their career who is organized, writes clearly, and wants to learn how a regulated healthcare company earns and keeps its certifications. You will have a lot of exposure to the entire security program.

What You Will Do

• Audit evidence and control documentation
  • Collect evidence for SOC 2 Type 2 and HITRUST including internal audit testing of controls.
  • Track control evidence status and keep the CISO informed.
  • Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts.
• Policy and vendor risk
  • Update security and privacy policies, manage versions, and track that people have read/acknowledged them.
  • Maintain documented proof that policies are being followed across the company.
  • Run third-party vendor risk assessments, document findings, and escalate anything that needs a decision.
• Privacy and data lifecycle
  • Support HIPAA and other healthcare compliance obligations alongside the CISO.
  • Support the data retention, de-identification, and disposal program.
  • Support the Privacy and Data Program.

What Success Looks Like

• Evidence for SOC 2 and HITRUST that is accurate, complete, and on time, with no recurring gaps.
• Policies that stay current, with documented proof people are following them.
• Vendor risk assessments finished on schedule, with risks written down and escalated appropriately.
• Retention, de-identification, and disposal actions happening on schedule and recorded.

Qualifications

• One to three years of experience in governance, risk and compliance, audit, or a related field.
• Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and the appetite to learn the others quickly.
• Clear, precise writing. Much of this role is producing documents other people depend on.
• Attention to detail, and the patience to track many small items to completion.
• Comfort following up with colleagues for evidence without being pushy.

Requirements

• Exposure to a GRC or compliance-automation platform.
• Experience in healthcare or another regulated industry.
• Familiarity with vendor risk assessments or BAA tracking.
• External audit exposure.

How you work

• You know when to resolve something yourself, escalate, and anticipate options.
• You follow through on small commitments without being reminded.
• You ask when something is unclear instead of guessing.
• You treat compliance as something that protects patients and caregivers, not as paperwork.

Benefits

• Full-time remote work
• Competitive base salary with final offer based on experience, skills, and location
• Comprehensive health, dental, and vision benefits
• Equity participation in a growing healthcare technology company
• PTO and a culture that respects it
• A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia

Additional Information

Employment is contingent on successful completion of a background check, consistent with applicable law.

Ceresti is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law.