← All roles

Senior GRC Analyst

Ambience Healthcare· Engineering
Apply on company site
Hybrid (San Francisco)$173.6k - $227.9k + equityFull-timePosted 3w ago

About the role

Senior GRC Analyst responsible for end-to-end governance, risk, and compliance program including SOC 2, PHI governance, vendor and AI-model risk, and security evidence for customers; emphasizes hands-on, policy-driven, and auditable security practices with use of AI coding tools to verify controls.

Responsibilities

  • Own the compliance program: Run SOC 2 end to end, including auditor relationship, evidence collection and interpretation in Vanta, and continuous audit readiness as infrastructure evolves; lay groundwork for AI governance frameworks like ISO 42001.
  • Bring rigor to PHI governance: Build and maintain an authoritative inventory of where PHI lives and which systems and models touch it, surface and close HIPAA and governance gaps.
  • Investigate controls first-hand: Use AI coding assistants analytically to verify whether a control (e.g., encryption at rest) is actually implemented, producing clear, evidenced answers without engineering hand-holding.
  • Stand up vendor and AI-model risk reviews: Build and run the security review process for new vendors and AI model providers, partnering with legal and finance to document risk assessments.
  • Drive risk to closure: Partner with engineering to enumerate, prioritize, and remediate security risks on a predictable, auditable cadence, and author security and compliance policies for engineers, legal, and GTM teams.
  • Be the front door for customer trust: Serve as first point of contact for RFPs and security questionnaires, and maintain a trust portal with current, customer-facing evidence.

Qualifications

  • Hands-on SOC 2 ownership: Senior-level GRC or compliance experience in a SaaS environment, including owning a SOC 2 audit from evidence collection through auditor sign-off, ideally using a GRC automation platform like Vanta or Drata.
  • Technical curiosity: Comfortable using an AI coding tool to answer compliance questions from source code, and able to threat-model a new vendor (data touched, data flows, required controls).
  • Clear writing and communication: Writes policies and standards auditable by auditors and usable by engineers; works with engineering, legal, and customers directly.
  • Startup ownership mindset: Thrives in ambiguity, builds accountable functions, and operates beyond narrow swim lanes.

Skills

Required:SOC 2 ownershipAI coding tool usage (e.g., Claude Code)Threat modeling
Nice to have:GRC automation (Vanta/Drata)

Benefits

  • Comprehensive medical, dental, and vision coverage for you and your dependents
  • 401(k) with a company match of up to 3% of base salary
  • Remote-friendly culture (San Francisco HQ) with full equipment provisioning
  • Parental leave
  • Annual company-wide and team off-sites, regular team lunches and all-hands with travel, lodging, meals covered
  • Flexible time off with no annual cap, holidays and an annual holiday shutdown Dec 24–Jan 1
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Ambience Healthcare

The AI Platform Clinicians Choose for Documentation and Coding

The AI Platform Clinicians Choose for Documentation and Coding

AI PlatformDocumentationCodingHealthcareHealth System
Company profileWebsite

More open roles at Ambience Healthcare