Senior Information Security GRC Analyst Vanta SOC 2 HIPAA

Job Title: Senior Information Security & GRC Analyst
Experience: 58 Years
Industry: Healthcare / HealthTech
Department: Information Security / Cybersecurity / GRC
Employment Type: Full-Time
Work Location: Perungudi, Chennai
Work Mode: Onsite

Timing: 7 PM IST to 4 AM IST (Night Shift)

Job Summary

We are looking for an experienced Senior Information Security & GRC Analyst with strong hands-on expertise in Governance, Risk & Compliance (GRC), SOC 2 audits, Vanta, HIPAA, IAM, and Cloud Security.

The ideal candidate must have prior experience in the Healthcare or HealthTech industry, with practical exposure to managing SOC 2 Type I and Type II compliance, audit readiness, evidence management, access governance, and security risk remediation.

The candidate will play a key role in maintaining continuous compliance through Vanta, coordinating with Engineering, IT, Cloud Infrastructure, and Management teams, and strengthening the organization's overall security and compliance posture.

This role also involves supporting GCP Cloud Security, FinOps monitoring, healthcare vendor risk management, and business continuity initiatives.

Key Responsibilities

1. GRC, SOC 2 & Compliance Management

• Manage and maintain the Vanta compliance platform for continuous monitoring, control tracking, and automated evidence collection.
• Drive SOC 2 Type I and Type II compliance activities and maintain ongoing audit readiness.
• Collect, review, validate, and maintain audit evidence, policies, procedures, and compliance documentation.
• Identify control gaps, coordinate remediation activities, and track corrective actions to closure.
• Support ISO 27001:2022 and HIPAA compliance initiatives.
• Coordinate internal and external audits and provide timely compliance status reports.

2. Identity & Access Management (IAM)

• Manage employee onboarding and offboarding security processes.
• Coordinate user access provisioning, modification, periodic access reviews, and timely access revocation.
• Maintain access governance processes and ensure compliance with least-privilege principles.
• Monitor access-related controls and maintain appropriate audit evidence.

3. GCP Cloud Security & FinOps

• Support GCP cloud security monitoring and configuration reviews.
• Work with Engineering teams on Google Cloud Security Command Center (SCC), firewall rule validation, and vulnerability remediation.
• Monitor GCP budgets, billing alerts, and cloud expenditure.
• Investigate unexpected cloud cost increases and anomalies.
• Coordinate with Engineering teams to identify root causes, implement corrective actions, and track FinOps follow-ups to closure.
• Support cloud security reviews and monitor cloud-related compliance controls.

4. Vulnerability & Risk Management

• Coordinate Vulnerability Assessment and Penetration Testing (VAPT) activities.
• Track identified vulnerabilities and coordinate remediation with technical teams.
• Conduct security risk assessments and monitor remediation progress.
• Maintain risk registers, security documentation, and compliance action trackers.

5. Healthcare Compliance & Vendor Risk Management

• Support healthcare vendor and third-party security risk assessments.
• Evaluate healthcare subprocessors and review Business Associate Agreements (BAAs), where applicable.
• Review and maintain PHI (Protected Health Information) data-flow documentation.
• Support HIPAA security and privacy compliance requirements.

6. Business Continuity & Incident Response

• Support Disaster Recovery (DR) planning, documentation, and testing.
• Coordinate Incident Response preparedness and testing activities.
• Work with management and VCISO advisors to strengthen security governance and incident management processes.

7. Management Reporting

• Prepare periodic reports covering compliance status, security risks, audit readiness, and outstanding remediation items.
• Report GCP billing anomalies, FinOps follow-ups, and cloud cost-related action items.
• Coordinate with Engineering, IT, Cloud, and Management teams to ensure timely closure of security and compliance activities.

Mandatory Skills & Qualifications

• 5+ years of experience in Information Security, Cybersecurity, Governance, Risk & Compliance (GRC), or Information Security Auditing.
• Hands-on experience with Vanta is mandatory.
• Strong practical experience in SOC 2 Type I and Type II compliance and audit readiness.
• Mandatory prior experience in the Healthcare / HealthTech industry.
• Good understanding of HIPAA compliance and PHI security requirements.
• Experience with security controls, risk assessments, audit evidence collection, and compliance documentation.
• Experience managing employee onboarding, offboarding, IAM, and user access reviews.
• Working knowledge of Google Cloud Platform (GCP) security and cloud infrastructure.
• Familiarity with GCP FinOps, budget monitoring, billing alerts, and cloud cost anomaly investigation.
• Knowledge of VAPT coordination, vulnerability management, and security remediation.
• Strong coordination, documentation, communication, and stakeholder management skills.

Preferred Qualifications

• ISO/IEC 27001:2022 Lead Implementer certification.
• Google Professional Cloud Security Engineer certification or equivalent GCP security certification.
• Experience configuring Google Cloud Security Command Center (SCC).
• Experience with healthcare vendor risk assessments, BAA management, and PHI data-flow reviews.
• Exposure to VCISO advisory, Disaster Recovery planning, and Incident Response testing.

Key Deliverables / Expected Outcomes

• Maintain continuous SOC 2 compliance readiness through Vanta.
• Ensure accurate, complete, and up-to-date audit evidence.
• Support successful SOC 2 Type I and Type II audits.
• Ensure timely employee access provisioning, periodic reviews, and access revocation.
• Maintain HIPAA and ISO 27001-related security controls and documentation.
• Coordinate timely closure of vulnerabilities, compliance gaps, and security risks.
• Strengthen GCP cloud security monitoring and governance.
• Track GCP billing alerts, investigate cost anomalies, and ensure FinOps action items are followed through to closure.

Who Should Apply?

Candidates with hands-on experience in Vanta, SOC 2, HIPAA, Healthcare GRC, IAM, and GCP Cloud Security who can independently manage compliance activities, coordinate audits, and work closely with technical and management teams are encouraged to apply.

Important: Vanta experience and prior Healthcare / HealthTech industry experience are mandatory for this position.