Security and Compliance Analyst, Pomelo Care

• The ideal candidate has a solid foundation in information security or GRC, strong project management skills, and a passion for improving processes in a dynamic healthcare startup environment
• Minimum 3 years of professional experience in GRC, cybersecurity, compliance, risk management, or a related field
• Experience coordinating or managing projects, including developing plans, tracking progress, and collaborating with stakeholders
• Excellent organizational skills and attention to detail
• Strong written and verbal communication skills
• Ability to work independently and prioritize multiple tasks in a fast-paced startup environment

Desirable

• Pomelo Care is seeking a proactive and detail-oriented Security and Compliance Analyst to support the development and execution of our information security and Governance, Risk, and Compliance (GRC) program
• In this role, you will collaborate across departments to help identify and mitigate cybersecurity risks, ensure regulatory compliance, and contribute to security and privacy initiatives
• Support the implementation and maintenance of Pomelo Care’s information security and GRC program, including policies, standards, and procedures
• Assist in performing security risk assessments and control evaluations across the organization
• Track and coordinate remediation activities for identified risks or compliance gaps
• Support third-party risk management activities, including vendor security reviews, user access reviews and due diligence assessments
• Participate in internal and external audits (e.g., SOC 2, HITRUST), including evidence collection and responding to the auditor. inquiries
• Help manage compliance with healthcare-specific regulations (e.g., HIPAA) and security frameworks
• Support the development and project management of security compliance workflows, including implementation of technical and administrative controls
• Develop and maintain metrics and dashboards to communicate GRC program status to stakeholders
• Document processes, workflows, and control narratives to support governance and compliance efforts
• Manage GRC or security-related projects, ensuring timely and quality delivery
• Provide support for security awareness and training initiatives