Governance, Risk & Compliance Manager

Join Fullscript as a Governance, Risk & Compliance (GRC) Manager. In this hands-on leadership role, you will drive our governance, risk, and compliance strategy while managing a team of two GRC professionals. You will own our security compliance program across multiple frameworks, lead internal and external audits, and partner closely with various teams to translate regulatory and customer requirements into practical security practices. This role is ideal for someone who enjoys balancing strategic program ownership with day-to-day execution in a fast-growing SaaS environment.

• Lead and mature Fullscript's security compliance program, ensuring continuous audit readiness across multiple frameworks.
• Manage a team of GRC professionals, providing hands-on leadership and fostering a culture of accountability and continuous improvement.
• Coordinate and lead internal and external audits, partnering closely with various departments to translate regulatory requirements into practical security practices.
• Hands-on experience owning enterprise compliance programs within SaaS or healthcare technology organizations
• Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders
• Experience managing control evidence, remediation programs, and continuous compliance activities
• Previous people management experience leading small, high-performing teams
• Strong understanding of security frameworks including NIST CSF, CIS Controls, ISO 27001, and HITRUST
• Strong project management and organizational skills with the ability to manage competing priorities
• HITRUST
• SOC 2 Type II
• Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives
• Demonstrated success leading external audits for:
• PCI DSS
• Familiarity with HIPAA and its requirements
• Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance
• 7+ years of experience in Governance, Risk & Compliance, Information Security, IT Audit, or Security Compliance
• Healthcare or health technology experience
• Professional certifications such as CISSP, CISA, CRISC, CISM, HITRUST CCSFP, PCI ISA/QSA, or ISO 27001 Lead Auditor
• Experience with GRC platforms such as Vanta, Drata, OneTrust, or similar
• Experience supporting customer security reviews and enterprise sales due diligence