Job description

About Ceresti Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. We envision a world in which family caregivers of people living with dementia are supported and have the knowledge, skills, and confidence to provide the best possible care for their loved ones. Ceresti is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. We offer health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs. Our culture is rooted in agility, innovation, and collaboration. We believe every idea—no matter how small—can spark a meaningful improvement. Together, we create solutions that make a lasting impact on the healthcare ecosystem, enabling more compassionate and cost-effective care for those who need it most. The Role Ceresti's security and privacy controls only count if we can prove they work. As GRC Analyst, you turn what the security team does every day into documented, audit-ready evidence — the record behind our SOC 2, HITRUST, and HIPAA obligations. You will report to the Chief Information Security Officer and work across Security, IT, Engineering, and Operations: gathering evidence, keeping policies current, assessing vendors, and supporting the privacy and data program. This is the governance side of security. The Security Analyst operates and monitors the controls; you prove they are working. This role is targeted to someone early in their career who is organized, writes clearly, and wants to learn how a regulated healthcare company earns and keeps its certifications. You will have a lot of exposure to the entire security program. What You Will Do Audit evidence and control documentation • Collect evidence for SOC 2 Type 2 and HITRUST including internal audit testing of controls. • Track control evidence status and keep the CISO informed. • Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts. Policy and vendor risk • Update security and privacy policies, manage versions, and track that people have read/acknowledged them. • Maintain documented proof that policies are being followed across the company. • Run third-party vendor risk assessments, document findings, and escalate anything that needs a decision. Privacy and data lifecycle • Support HIPAA and other healthcare compliance obligations alongside the CISO. • Support the data retention, de-identification, and disposal program. • Support the Privacy and Data Program. What Success Looks Like In the first year, we would expect to see: • Evidence for SOC 2 and HITRUST that is accurate, complete, and on time, with no recurring gaps. • Policies that stay current, with documented proof people are following them. • Vendor risk assessments finished on schedule, with risks written down and escalated appropriately. • Retention, de-identification, and disposal actions happening on schedule and recorded. What You Bring Required • One to three years of experience in governance, risk and compliance, audit, or a related field. • Working knowledge of at least one of SOC 2, HITRUST, or HIPAA, and the appetite to learn the others quickly. • Clear, precise writing. Much of this role is producing documents other people depend on. • Attention to detail, and the patience to track many small items to completion. • Comfort following up with colleagues for evidence without being pushy. Preferred • Exposure to a GRC or compliance-automation platform. • Experience in healthcare or another regulated industry. • Familiarity with vendor risk assessments or BAA tracking. • External audit exposure. How you work • You know when to resolve something yourself, escalate, and anticipate options. • You follow through on small commitments without being reminded. • You ask when something is unclear instead of guessing. • You treat compliance as something that protects patients and caregivers, not as paperwork. What We Offer • Full-time remote work • Competitive base salary with final offer based on experience, skills, and location • Comprehensive health, dental, and vision benefits • Equity participation in a growing healthcare technology company • PTO and a culture that respects it • A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia Additional Information Employment is contingent on successful completion of a background check, consistent with applicable law. Ceresti is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law.

Requirements

Must-haves

Audit evidence and control documentation
Collect evidence for SOC 2 Type 2 and HITRUST including internal audit testing of controls.
Track control evidence status and keep the CISO informed.
Coordinate with control owners across Security, IT, and Engineering to gather audit artifacts.
Policy and vendor risk
Update security and privacy policies, manage versions, and track that people have read/acknowledged them.
Maintain documented proof that policies are being followed across the company.
Run third-party vendor risk assessments, document findings, and escalate anything that needs a decision.
Privacy and data lifecycle
Support HIPAA and other healthcare compliance obligations alongside the CISO.
Support the data retention, de-identification, and disposal program.
Support the Privacy and Data Program.
What Success Looks Like
In the first year, we would expect to see:
Evidence for SOC 2 and HITRUST that is accurate, complete, and on time, with no recurring gaps.

Nice-to-haves

Exposure to a GRC or compliance-automation platform.
Experience in healthcare or another regulated industry.
Familiarity with vendor risk assessments or BAA tracking.
External audit exposure.
How you work
You know when to resolve something yourself, escalate, and anticipate options.
You follow through on small commitments without being reminded.
You ask when something is unclear instead of guessing.
You treat compliance as something that protects patients and caregivers, not as paperwork.

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: breezy
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

Pto