Senior Manager

Virta Health is on a mission to reverse metabolic disease in one billion people. As our Senior Manager of GRC, you will have a high-impact, transformative opportunity to lead Virta’s Governance, Risk, and Compliance (GRC) function in a highly automated, AI-first environment. You will be the ultimate champion of security compliance and risk culture across the enterprise—collaborating closely with Sales to unblock commercial velocity, supervising compliance audits, and hardening our HIPAA, HITRUST, and SOC 2 frameworks. If you are passionate about driving risk governance, designing automated evidence collection, and enabling employees with frictionless SaaS reviews and compliance workflows, this role is your opportunity to redefine healthcare compliance. 90 Day Plan Within your first 90 days at Virta, we expect you will do the following: First 30 days: Deep dive into our current GRC tool configurations (Vanta), evaluate our control framework status, meet with key stakeholders across IT and Security Engineering, and take ownership of the daily employee SaaS review and GRC request queue. Day 30-60: Establish baseline SLAs for employee compliance requests (SaaS reviews, access reviews) and optimize automation workflows to streamline customer security questionnaire and RFP responses. Initiate coordination with external auditors and partners for upcoming assessments. Day 60-90: Complete a comprehensive internal risk assessment and present a clean, unified risk and compliance metric dashboard to senior leadership covering GRC control health, exception trends, and upcoming audit preparation timelines. Must-Haves 7+ years of dedicated experience in Cybersecurity GRC, IT Auditing, or Information Security Compliance, with at least 2+ years leading programs or managing teams in regulated environments (such as Healthcare or Digital Health). Direct, hands-on experience managing and maintaining at least one of the major security and healthcare frameworks, specifically HITRUST CSF, HIPAA, and SOC 2. Proven track record of leveraging modern SaaS GRC automation platforms (such as Vanta or Drata) to scale continuous compliance programs. Outstanding client-facing communication skills with a track record of partnering with Sales/CS teams to navigate complex enterprise security evaluations, vendor questionnaires, and RFP processes. Successfully designed and implemented repeatable AI-enabled workflows that address team bottlenecks and improve efficiency. Ability to operate in gray areas, finding the right balance between corporate risk tolerance, operational efficiency, and regulatory requirements. Strong cross-functional leadership skills with the ability to influence technical and non-technical business partners to align on security compliance objectives. Values-driven culture Virta’s company values drive our culture, so you’ll do well if: You put people first and take care of yourself, your peers, and our patients equally You have a strong sense of ownership and take initiative while empowering others to do the same You prioritize positive impact over busy work You have no ego and understand that everyone has something to bring to the table regardless of experience You appreciate transparency and promote trust and empowerment through open access of information You are evidence-based and prioritize data and science over seniority or dogma You take risks and rapidly iterate Is this role not quite what you're looking for? Join our Talent Community and follow us on Linkedin to stay connected! Virta has a location based compensation structure. Starting pay will be based on a number of factors and commensurate with qualifications & experience. For this role, the compensation range is $161,500-209,000/year. Information about Virta’s benefits is on our Careers page at: https://www.virtahealth.com/careers. As part of your duties at Virta, you may come in contact with sensitive patient information that is governed by HIPAA. Throughout your career at Virta, you will be expected to follow Virta's security and privacy procedures to ensure our patients' information remains strictly confidential. Security and privacy training will be provided. As a remote-first company, our team is spread across various locations with office hubs in Denver and San Francisco. Clinical roles: We currently do not hire in the following states: AK, HI, RI Corporate roles: We currently do not hire in the following states: AK, AR, DE, HI, ME, MS, NM, OK, SD, VT, WI. Virta uses Ashby as its applicant tracking system, which incorporates AI-powered tools in certain aspects of the recruiting process; your data is not used to train AI models, and all final hiring decisions are made by Virta Health personnel. Apply for this Job.