Senior Governance, Risk & Compliance Analyst, Ro

• 5 years’ experience working with risk and compliance frameworks (HIPAA, NIST, HITRUST, SOC2)
• 3 years of demonstrated success in audit readiness activities
• 3 years experience in drafting Information Security & Privacy policy
• Understanding of digital ecommerce platforms, , electronic health records (EHR) systems, and traditional business-enabling IT services
• Knowledge of cloud computing platforms (e.g., Amazon Web Services, Microsoft Azure, Google Cloud) and their security and compliance features
• Strong analytical and root cause analysis skills
• Ability to communicate to all levels of the organization

Desirable

• The Governance Risk and Compliance Sr. Analyst role will be a core member of Ro’s GRC team. The GRC team enables Ro to de-risk our mission of helping patients unlock their healthcare goals by vigorously assessing our operations against leading compliance frameworks and standing legislation
• This individual contributor role will be a key player in executing Ro’s GRC Program by partnering with our business functions to assess our audit readiness for our external obligations (HITRUST, SOC2 & HIPAA)
• The Sr. GRC Analyst will redefine our information security & privacy policies and rebaseline our Security Training Program
• Optimize our existing Information Security & Privacy Policies to best serve our businesses and stakeholders
• Align and refresh our Security Training Program with industry best practices
• Automate compliance reviews on critical processes to ensure compliance to our policies. Perform manual reviews as required
• Partner with stakeholder groups (Infra, Engineering, Legal, Cyber) to identify and manage risk from exceptions to policy
• Ready the organization for internal or external audits through controls testing, compliance reviews, user education and training
• Validate evidence to ensure it meets audit requirements