Governance, Risk & Compliance (GRC) Lead – Information Security & Risk

Role Overview

The GRC Lead will be responsible for developing, implementing, and maintaining iCareManager’s governance, risk, and compliance framework. The role ensures continued compliance with SOC 2 Type 2, HIPAA, and other regulatory and security frameworks, while driving consistent, measurable processes across departments.

This position connects three key areas of iCM’s security model:

• GRC & Compliance Oversight (this role)
  

• Internal IT Security Operations
  

• External Managed Detection and Response (MDR) Partner
  

While this is not a hands-on technical role, it requires strong understanding of IT and security controls to ensure governance, documentation, and accountability are in place.

Key Responsibilities

• Lead and sustain SOC 2 Type 2 certification, ensuring alignment with Trust Services Criteria.
  

• Administer and manage the Vanta compliance automation platform — track controls, evidence, and remediation.
  

• Translate company policies into department-level procedures and monitor compliance activities.
  

• Conduct quarterly and annual risk assessments; maintain the Risk Register with mitigation tracking.
  

• Serve as liaison between IT Security and MDR provider to ensure continuous monitoring and evidence collection for audits.
  

• Coordinate external audits and ensure timely collection of compliance documentation and evidence.
  

• Maintain a compliance calendar covering monthly policy checks, quarterly internal audits, and annual risk assessments.
  

• Track and report control status, incidents, and audit findings to closure with department heads.
  

• Drive company-wide security and compliance awareness training.
  

• Promote a culture of proactive compliance, governance, and continuous improvement.