GRC Analyst

Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. We envision a world in which family caregivers of people living with dementia are supported and have the knowledge, skills, and confidence to provide the best possible care for their loved ones.

Ceresti is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. We offer health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs.

Our culture is rooted in agility, innovation, and collaboration. We believe every idea—no matter how small—can spark a meaningful improvement. Together, we create solutions that make a lasting impact on the healthcare ecosystem, enabling more compassionate and cost-effective care for those who need it most.

Ceresti's security and privacy controls only count if we can prove they work. As GRC Analyst, you turn what the security team does every day into documented, audit-ready evidence — the record behind our SOC 2, HITRUST, and HIPAA obligations.

You will report to the Chief Information Security Officer and work across Security, IT, Engineering, and Operations: gathering evidence, keeping policies current, assessing vendors, and supporting the privacy and data program. This is the governance side of security. The Security Analyst operates and monitors the controls; you prove they are working.

This role is targeted to someone early in their career who is organized, writes clearly, and wants to learn how a regulated healthcare company earns and keeps its certifications. You will have a lot of exposure to the entire security program.

• Collect evidence for SOC 2 Type 2 and HITRUST including internal audit testing of controls.
• Track control evidence status and keep the CISO informed.
• Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts.

• Update security and privacy policies, manage versions, and track that people have read/acknowledged them.
• Maintain documented proof that policies are being followed across the company.
• Run third‑party vendor risk assessments, document findings, and elevate anything that needs a decision.

• Support HIPAA and other healthcare compliance obligations alongside the CISO.
• Support the data retention, de‑identification, and disposal program.
• Support the Privacy and Data Program.

In the first year, we would expect to see:

• Evidence for SOC 2 and HITRUST that is accurate, complete, and on time, with no recurring gaps.
• Policies that stay current, with documented proof people are following them.
• Vendor risk assessments finished on schedule, with risks written down and escalated appropriately.
• Retention, de‑identification, and disposal actions happening on schedule and recorded.

• One to three years of experience in governance, risk and compliance, audit, or a related field.
• Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and the appetite to learn the others quickly.
• Clear, precise writing. Much of this role is producing documents other people depend on.
• Attention to detail, and the patience to track many small items to completion.
• Comfort following up with colleagues for evidence without being pushy.

• Exposure to a GRC or compliance‑automation platform.
• Experience in healthcare or another regulated industry.
• Familiarity with vendor risk assessments or BAA…