Senior Manager, GRC

About the Role:

We're looking for a GRC Manager to own governance, risk, and compliance for our B2B health benefits platform. You'll act as the team lead for our GRC function, working closely with one other team member to run audits, write policies, answer RFIs, and monitor controls day to day.

This role touches almost every team: partnering with Engineering, IT, and HR to gather evidence and close gaps; working directly with customers and their security teams during due diligence; and managing auditor relationships through certification cycles. You'll also bring solid project management skills, sequencing audits, tracking remediation, and hitting deadlines across multiple concurrent workstreams. You'll report directly to the CISO/Head of Security and act as the organization's primary voice on compliance posture. You will interface internally and externally with customers, auditors, and partners.

Our platform facilitates virtual health visits for employer-sponsored benefits, which means security, privacy, and compliance are core to customer trust and our ability to sell into enterprise and health-plan accounts.

What You'll Do:

External Audit & Certification Management

• Own continuation and renewal of our SOC 2 (Type II) and HITRUST certifications end-to-end. You'll scope each cycle, pull evidence, work directly with auditors, and track remediation through to the final report.
• Lead the ground-up establishment of ISO 27001 and ISO 42001 certification programs. That means gap assessments, control mapping, writing ISMS/AIMS policies and statements of applicability, gaining cross team buy in, and getting us ready for initial certification audits.
• Manage the annual/ongoing audit calendar across all frameworks, coordinating with internal stakeholders (Engineering, IT, HR, Legal) to gather evidence and close findings on time.
• Track regulatory and framework changes (HIPAA, state privacy laws, ISO updates) and translate them into control updates.

Customer-Facing Security & Compliance

• Serve as the primary owner of security questionnaires and RFIs/RFPs for the Sales and Customer Success teams. Ensure responses to prospect and customer’s due-diligence requests are accurate and on deadline.
• Maintain a security knowledge base / answer library to reduce turnaround time on recurring questions.
• Partner with Sales Engineering and Account teams to represent our security and compliance posture directly in customer calls when needed. You'll join customer calls directly when security is a blocker in the deal.
• Manage relationships with customers' internal security/compliance teams during onboarding and renewal cycles.

Internal Audit & Control Monitoring

• Build and run an internal audit/control-monitoring program focused first on verifying that externally audited controls are actually operating day-to-day. 
• Flag control gaps or process drift to the CISO/Head of Security before they become audit findings.
• Over time, expand scope beyond audited-control verification into broader internal audit territory (policy adherence, vendor risk, operational risk) as bandwidth allows.

What You'll Bring:

Required:

• 6+ years of experience in GRC, information security compliance, or IT audit, with direct ownership of at least one SOC 2 or similar audit cycle from start to finish.
• Working knowledge of SOC 2, HITRUST, and ISO 27001 frameworks hands-on .
• Experience responding to customer security questionnaires/RFIs, ideally in a B2B SaaS or healthcare-adjacent environment.
• Strong cross-team collaboration skills. You'll regularly work with Engineering, IT, HR, Legal, and Sales to gather evidence, close control gaps, and keep everyone aligned on deadlines.
• Solid project management instincts: able to sequence overlapping audits and certification projects, track dependencies and remediation items, and hit dates without needing someone else to manage the plan for you.
• Strong written communication; you'll be writing policies, RFI responses, and audit narratives that both auditors and non-technical stakeholders need to understand.

Strongly preferred:

• Direct experience standing up a new certification (SOC2, HITRUST, ISO 27001 and/or the newer 42001 AI management standard) rather than just maintaining an existing one.
• Experience with GRC/compliance automation tooling (Vanta, Drata, Secureframe, Hyperproof, or similar).
• Background in health tech, digital health, or another regulated B2B vertical (fintech, insurtech) where compliance is a sales enabler.
• A relevant certification such as CISA, CRISC, CISSP, PMP or CAPM, CISM, CTRC/CAP.
• Exposure to vulnerability management or IT operations well enough to meaningfully audit those processes rather than just take reports at face value.
• Experience partnering with Sales/Sales Engineering as a technical or compliance resource during the deal cycle.

The base salary range for this role is $170,000 - $201,000 per year. You will also be entitled to receive equity and benefits. Individual pay decisions are based on a number of factors, including qualifications for the role, experience level, and skillset.

Maven embraces a flexible hybrid work model. Our teams primarily operate from the New York Metropolitan area, NY, and remotely via San Francisco/Bay Area, CA, Seattle, WA. For those in our New York City office, we encourage in-person collaboration by requiring team members to work onsite three days a week  (Tuesday, Wednesday, Thursday). For those based in Boston, DC, Chicago, Seattle, and San Francisco, we encourage in-person collaboration by requiring team members to attend monthly Work Together Days within these cities. This policy aims to balance remote work flexibility with the benefits of face-to-face interaction.