Governance (GRC) Lead

The Governance, Risk, and Compliance Lead is responsible for strengthening the organization's governance and compliance programs by documenting operational processes, maintaining internal controls, and supporting audit readiness initiatives. This position works across business functions to ensure operational procedures accurately reflect day-to-day activities, control requirements are consistently executed, and compliance evidence is readily available for external assessments.

This role serves as a key operational partner to Compliance leadership and business stakeholders by improving process maturity, promoting accountability, and helping the organization sustain compliance with regulatory and industry frameworks. While this position supports external audit activities, it is not responsible for conducting independent audits or issuing compliance opinions.

Key Responsibilities

Business Process Documentation

• Collaborate with Operations, Information Technology, Security, and business leaders to identify undocumented or evolving business processes.
• Conduct interviews and process reviews to understand how work is performed and identify opportunities for standardization.
• Develop, maintain, and update Standard Operating Procedures (SOPs), workflows, and process documentation.
• Ensure documentation remains accurate as business operations, technologies, and organizational requirements change.
• Recommend process improvements that enhance operational efficiency while supporting compliance objectives.

Governance & Internal Controls

• Maintain documentation of internal controls supporting compliance frameworks including SOC 2, PCI DSS, and HIPAA.
• Associate documented procedures with applicable controls, business systems, and process owners.
• Coordinate recurring governance reviews to verify control execution and ongoing compliance.
• Monitor control performance, track remediation activities, and assist with follow-up actions for identified gaps.
• Support risk assessments by ensuring operational documentation accurately reflects current business practices.

Audit Readiness

• Coordinate the collection and organization of evidence required for external compliance assessments.
• Review documentation for completeness, consistency, and alignment with established control requirements before auditor review.
• Serve as a primary point of coordination between internal stakeholders and external auditors under the guidance of Compliance leadership.
• Track audit requests, evidence submissions, findings, and corrective action plans.
• Maintain organized documentation that supports repeatable and efficient audit cycles.

Cross-Functional Collaboration

• Educate business process owners on governance expectations and control responsibilities.
• Promote accountability for process execution while allowing operational teams to retain ownership of their business functions.
• Work closely with Compliance leadership to prioritize governance initiatives, compliance activities, and process improvements.
• Foster strong working relationships across departments to improve organizational compliance awareness and operational consistency.

Additional Responsibilities

• Perform additional duties as assigned.
• Maintain professional communication and collaboration across all levels of the organization.
• Support flexible work schedules and occasional overtime as business needs require.
• Comply with all company policies, security standards, and applicable regulatory requirements.

Qualifications

Required

• Bachelor's degree in Business, Information Systems, Risk Management, Compliance, or a related discipline preferred.
• Five or more years of experience in governance, compliance, risk management, business analysis, operational excellence, or similar disciplines.
• Experience documenting operational procedures and business processes within regulated environments.
• Experience supporting organizational readiness for external compliance assessments such as SOC 2, PCI DSS, HIPAA, or comparable frameworks.
• Working knowledge of internal controls and their relationship to business processes.
• Strong facilitation and communication skills with the ability to collaborate across multiple functional areas.
• Excellent organizational, analytical, and technical writing abilities.

Preferred

• Experience working within organizations that manage sensitive customer, healthcare, or financial information.
• Familiarity with governance frameworks including SOC 2 Trust Services Criteria, PCI DSS, HIPAA Security Rule, and NIST 800-53.
• Previous experience as a Governance, Risk & Compliance (GRC) Analyst, Business Process Analyst, Internal Controls Analyst, Compliance Consultant, or similar role.
• Experience establishing or expanding governance and compliance programs within growing organizations.

Core Competencies

• Strong attention to detail with the ability to balance compliance requirements and operational efficiency.
• Skilled at evaluating business processes through observation, interviews, and documentation.
• Ability to manage multiple governance initiatives and recurring compliance activities simultaneously.
• Practical approach to solving process and compliance challenges.
• Effective relationship builder capable of influencing stakeholders without direct management authority.
• Self-motivated, organized, and comfortable working in cross-functional environments.