Senior Manager of Governance, Risk & Compliance, Virta Health
$161.5-209k
Offers Equity
More information about location
Diabetes reversal & weight loss treatments
Be an early applicant
Diabetes reversal & weight loss treatments
501-1000 employees
Be an early applicant
$161.5-209k
Offers Equity
More information about location
501-1000 employees
Company mission
To reverse metabolic disease in one billion people
Role
Who you are
- 7+ years of dedicated experience in Cybersecurity GRC, IT Auditing, or Information Security Compliance, with at least 2+ years leading programs or managing teams in regulated environments (such as Healthcare or Digital Health)
- Direct, hands-on experience managing and maintaining at least one of the major security and healthcare frameworks, specifically HITRUST CSF, HIPAA, and SOC 2
- Proven track record of leveraging modern SaaS GRC automation platforms (such as Vanta or Drata) to scale continuous compliance programs
- Outstanding client-facing communication skills with a track record of partnering with Sales/CS teams to navigate complex enterprise security evaluations, vendor questionnaires, and RFP processes
- Successfully designed and implemented repeatable AI-enabled workflows that address team bottlenecks and improve efficiency
- Ability to operate in gray areas, finding the right balance between corporate risk tolerance, operational efficiency, and regulatory requirements
- Strong cross-functional leadership skills with the ability to influence technical and non-technical business partners to align on security compliance objectives
- You put people first and take care of yourself, your peers, and our patients equally
- You have a strong sense of ownership and take initiative while empowering others to do the same
- You prioritize positive impact over busy work
- You have no ego and understand that everyone has something to bring to the table regardless of experience
- You appreciate transparency and promote trust and empowerment through open access of information
- You are evidence-based and prioritize data and science over seniority or dogma
- You take risks and rapidly iterate
What the job involves
- As our Senior Manager of GRC, you will have a high-impact, transformative opportunity to lead Virta’s Governance, Risk, and Compliance (GRC) function in a highly automated, AI-first environment
- You will be the ultimate champion of security compliance and risk culture across the enterprise—collaborating closely with Sales to unblock commercial velocity, supervising compliance audits, and hardening our HIPAA, HITRUST, and SOC 2 frameworks
- If you are passionate about driving risk governance, designing automated evidence collection, and enabling employees with frictionless SaaS reviews and compliance workflows, this role is your opportunity to redefine healthcare compliance
- Information Security GRC Program Management: Maintain and mature Virta Health's information security compliance program, policies, procedures, and controls to address emerging risks as the organization scales. Continuously evaluate and enhance the GRC framework to align with industry best practices and regulatory requirements. This is inclusive of:
- Lead GRC & Compliance Automation: Oversee Virta’s GRC function, scaling our platform (Vanta) to automate continuous evidence collection, ensuring audit-readiness and defending our HIPAA, HITRUST CSF, and SOC 2 certifications
- Enable Commercial Velocity (RFPs & Security Questionnaires): Partner directly with Sales and Customer Success to navigate enterprise customer evaluations and security reviews, communicating Virta's strong security compliance posture to external stakeholders
- Own Policy, Risk & Compliance Governance: Define and own Virta's security policy lifecycle, exception management processes, vendor risk assessments, and executive risk reporting. Conduct regular risk assessments to identify vulnerabilities, assess potential impact, and guide business owners on mitigation
- Champion GRC Employee Experience: Manage the administrative security queue for Virta employees. Design and optimize frictionless ticketing workflows (such as Zendesk or Jira) and SLAs for access governance reviews, SaaS tool compliance evaluations, and policy exception requests
- Coordinate Cross-Functional Security Alignment: Collaborate closely with IT, Enterprise Security Engineering, and Product Development teams to ensure operational GRC policies map seamlessly into our technical architectures and evolving AI governance frameworks (e.g., ISO 42001, NIST AI RMF)
- Security Awareness & Compliance Training: Champion a culture of security awareness across all levels of the organization. Design and deliver targeted training programs so employees understand their roles in maintaining compliance and data privacy
- Within your first 90 days at Virta, we expect you will do the following:
- First 30 days: Deep dive into our current GRC tool configurations (Vanta), evaluate our control framework status, meet with key stakeholders across IT and Security Engineering, and take ownership of the daily employee SaaS review and GRC request queue
- Day 30-60: Establish baseline SLAs for employee compliance requests (SaaS reviews, access reviews) and optimize automation workflows to streamline customer security questionnaire and RFP responses. Initiate coordination with external auditors and partners for upcoming assessments
- Day 60-90: Complete a comprehensive internal risk assessment and present a clean, unified risk and compliance metric dashboard to senior leadership covering GRC control health, exception trends, and upcoming audit preparation timelines
Our take
Much of the care for type 2 diabetes has been based on control and prevention, rather than a direct reversal of the issue. Virta Health is changing that, providing patients with personalized treatment plans, virtual monitoring and patient care.
Instead of depending upon medication, which often needs to be increased over time, the company is tackling the problem at its root and taking a fundamentally different approach that is better for the patient, and more economical for insurers. Among enrolled patients in its clinical trial at one year, 60% achieved diabetes reversal.
While other platforms serve similar markets, the large number of prediabetic and diabetic Americans presents a significant opportunity for growth. The company is well-funded and continues to expand the reach of its telehealth-powered diabetes reversal treatment - positioning itself for widespread adoption as it addressies this critical healthcare challenge.
Steph
Company Specialist at Welcome to the Jungle
Insights
4% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Apr 2021
$133m
SERIES E
Dec 2020
$65m
SERIES D
Total funding: $373m
Company benefits
- Remote-first work environment with ability to work from home
- Flexible work hours & time off policy
- Virta pays 99% of all employee health insurance premiums, and 75% for all dependents
- Up to 16 weeks paid parental leave
- Enroll in the Virta treatment for free and give a discount to friends and family
- Internet, home office, learning & development stipends
- Employee Resource Groups like Parents of Virta, Ladies of Virta, and Virtans for DEI
- 401K and ROTH contribution opportunities
Company HQ
Civic Center, Denver, CO
Leadership
Sami Inkinen
(CEO & Co-Founder)Worked on Microsoft’s strategy team for MS Office, and as a consultant for McKinsey & Company. Co-founder of online real estate marketplace Trulia, serving as its COO until its IPO and eventual sale to Zillow Group.
Share this job
View 13 more jobs at Virta Health