Governance, Risk & Compliance Manager, Fullscript

• 7+ years of experience in Governance, Risk & Compliance, Information Security, IT Audit, or Security Compliance
• Previous people management experience leading small, high-performing teams
• Hands-on experience owning enterprise compliance programs within SaaS or healthcare technology organizations
• Demonstrated success leading external audits for:
• SOC 2 Type II
• PCI DSS
• HITRUST
• Familiarity with HIPAA and its requirements
• Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders
• Strong understanding of security frameworks including NIST CSF, CIS Controls, ISO 27001, and HITRUST
• Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives
• Experience managing control evidence, remediation programs, and continuous compliance activities
• Strong project management and organizational skills with the ability to manage competing priorities
• Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance

Desirable

• We're looking for an experienced Governance, Risk & Compliance (GRC) Manager to lead and mature Fullscript's security compliance program. This is a hands-on leadership role responsible for driving our governance, risk, and compliance strategy while directly managing a team of two GRC professionals
• You'll own our security compliance program across multiple frameworks, including SOC 2 Type II, PCI DSS, and HITRUST, ensuring we remain continuously audit-ready while scaling our controls alongside the business
• You'll lead internal and external audits, partner closely with Security, Engineering, Infrastructure, Privacy, Legal, Product, and IT, and help translate regulatory and customer requirements into practical, scalable security practices
• This role is ideal for someone who enjoys balancing strategic program ownership with day-to-day execution and who thrives in highly collaborative, fast-growing SaaS environments
• Governance & Compliance:
• Own and evolve Fullscript's Governance, Risk & Compliance program
• Maintain and continuously improve compliance across SOC 2 Type II, PCI DSS, and HITRUST
• Develop and maintain policies, standards, procedures, and control documentation
• Ensure compliance activities are embedded into operational processes rather than point-in-time exercises
• Track regulatory, contractual, and customer compliance obligations and ensure appropriate control coverage
• Audit & Assurance:
• Lead all external compliance audits, including planning, evidence collection, auditor coordination, issue resolution, and successful certification
• Manage internal control assessments and readiness activities throughout the year
• Coordinate remediation efforts across Engineering, IT, Security, and business teams
• Own relationships with external auditors and assessment firms
• Develop reporting and dashboards that communicate compliance posture and audit readiness to leadership
• Risk Management:
• Partner with Security leadership to mature enterprise security risk management
• Maintain risk registers and facilitate risk assessments across technology and business functions
• Drive remediation planning and track progress through completion
• Support third-party risk management activities as required
• Cross-Functional Partnership:
• Build strong partnerships with Privacy and Legal to ensure alignment between security, regulatory, and privacy obligations
• Partner with Product, Engineering, Infrastructure, and IT to operationalize security controls
• Support customer security reviews, due diligence requests, and compliance questionnaires
• Provide practical guidance that enables business growth while maintaining an appropriate risk posture
• Leadership:
• Lead, coach, and develop a team of two GRC professionals
• Establish team priorities, operating cadence, and professional development plans
• Foster a culture of accountability, continuous improvement, and operational excellence
• Remain actively involved in execution, serving as a working manager who contributes directly to audits, control implementation, and compliance initiatives
• Trust is one of Fullscript's most important products
• As our GRC Manager, you'll help ensure that our security and compliance programs scale alongside the business, enabling innovation while maintaining the confidence of our customers, partners, and regulators
• You'll have the opportunity to shape the future of our compliance program, mentor a growing team, and influence security strategy across the organization

• A quick note: Due to the high volume of applications, we’re not able to respond to phone or email inquiries about application status. If there’s a match, our team will reach out directly