Senior Security Governance Risk & Compliance (GRC) Analyst

Position Overview

• Location Type: Remote
• Employment Type: Full-time
• Salary: Not specified

Alma is on a mission to simplify access to high-quality, affordable mental health care. We do this by making it easy and financially rewarding for therapists to accept insurance and offer in-network care. When a provider joins Alma, they gain access to a suite of tools that not only help them better run their business, but also grow it sustainably and develop as a provider. Alma is available in all 50 states, with over 20,000 therapists in our growing network. Anyone looking for a therapist can browse Alma’s free directory. Alma has raised $220.5M in funding from Insight Partners, Optum Ventures, Tusk Venture Partners, Primary Venture Partners, First Round Capital, Sound Ventures, BoxGroup, Cigna Ventures, and Rainfall Ventures. Alma was also named one of Inc’s Best Workplaces in 2022 and 2023.

• Website
• Job Board
• Values
• Candidate Interview Guide

Senior Security Governance Risk & Compliance (GRC) Analyst

Alma is seeking a mission-driven Senior Security Governance Risk and Compliance (GRC) Analyst to join our team. We are dedicated to building secure and compliant tools and services that help providers more easily manage and grow their practice. Acting as a principal aide to the VP of Security and IT, this role will play a critical role in enabling a culture of security at Alma, making security a product differentiator that builds confidence and trust with our providers, and preparing Alma for annual audits and certifications (such as SOC 2 and HITRUST).

Responsibilities

• Perform risk assessments and reports on Alma’s risk management program.
• Collaborate with stakeholders to identify and facilitate the implementation of mitigating controls.
• Streamline and maintain Alma’s security policies and standards.
• Prepare the organization and facilitate annual audits and certifications (SOC 2, PCI).
• Educate Alma’s staff by creating and managing an effective security awareness program.
• Develop our vendor risk program, ensuring our vendors meet Alma security standards.
• Develop Alma’s Trust program, preparing materials and responses to security assessments, and making security a product differentiator that builds confidence and instills trust in our providers.
• Develop and measure key metrics, and coordinate activities in support of cybersecurity priorities.

Requirements

• 5+ years of work experience in Information Security, especially in a GRC analysis role.
• Experience working in health tech or other highly regulated industries (banking, insurance, etc.).
• Experience leading SOC 2 audits and/or HITRUST certifications with minimal findings.
• Experience deploying GRC solutions (Drata or equivalent), putting in place a unified control framework enabling evidence collection.