Security GRC Manager

Rightway is seeking a Security GRC Manager to lead and strengthen the governance, risk and compliance function at this healthcare company. Rightway helps patients navigate care and medications through a mobile app that puts clinicians, pharmacists and health guides at their side. Its main office sits in New York City, and it also has offices in Denver and Dallas. The posting notes that the company has raised more than $300 million from investors.

The manager would lead and coach a small GRC group, set its priorities and review its output. Major areas include maintaining the unified control library that maps SOC 2, SOC 1 and HITRUST requirements, running the audit program alongside Engineering, IT, People and Finance, and delivering the combined SOC 2 and HITRUST attestation as the company expands. The role also addresses HIPAA and HITECH privacy obligations with Legal, covering business associate agreements and breach analysis, plus an AI governance program built on ISO/IEC 42001 with an AI risk register. Additional duties include reviewing security and privacy clauses in customer and vendor contracts, tracking control performance in Drata, leading continuity planning backed by a business impact analysis, reworking third-party risk oversight, maintaining the enterprise risk register, and running the customer assurance function, which covers security questionnaires, RFP responses and the trust center.

Applicants should bring five to ten years of relevant experience and a recognized certification such as CISSP, CISA or CISM. The posting asks for hands-on success leading a SOC 2 and HITRUST effort at a fast-growing company, familiarity with AI governance standards, and a firm grasp of HIPAA and HITECH, including the distinction between covered entities and business associates. Comfort with risk assessment methods, negotiating business associate agreements, and understanding development lifecycles and security tooling is expected. Joint SOC 2 and HITRUST attestation experience is a bonus. The listed pay is $144,000 to $175,000 a year, plus bonus and equity, with the final figure set by location, experience and qualifications.