{"id":239616,"url":"https://alion.io/job/fullscript-governance-risk-compliance-grc-manager","title":"Governance, Risk & Compliance (GRC) Manager","company":{"id":9061,"name":"Fullscript","domain":"fullscript.com","url":"https://alion.io/company/fullscript","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ottawa, Canada","Toronto, Canada","Calgary, Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":63000,"max_usd":128000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":9},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-02T14:08:47Z","employer_posted_date":"2026-09-02","last_verified_at":"2026-10-31T01:47:57Z","board_verified":true,"closed_at":null,"days_open":58,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":58},"description":"The Opportunity\nWe're looking for an experienced Governance, Risk & Compliance (GRC) Manager to lead and mature Fullscript's security compliance program. This is a hands-on leadership role responsible for driving our governance, risk, and compliance strategy while directly managing a team of two GRC professionals.\nYou'll own our security compliance program across multiple frameworks, including SOC 2 Type II, PCI DSS, and HITRUST, ensuring we remain continuously audit-ready while scaling our controls alongside the business. You'll lead internal and external audits, partner closely with Security, Engineering, Infrastructure, Privacy, Legal, Product, and IT, and help translate regulatory and customer requirements into practical, scalable security practices.\nThis role is ideal for someone who enjoys balancing strategic program ownership with day-to-day execution and who thrives in highly collaborative, fast-growing SaaS environments.\nWhat You'll Do\nGovernance & Compliance\nOwn and evolve Fullscript's Governance, Risk & Compliance program.\n\nMaintain and continuously improve compliance across SOC 2 Type II, PCI DSS, and HITRUST.\n\nDevelop and maintain policies, standards, procedures, and control documentation.\n\nEnsure compliance activities are embedded into operational processes rather than point-in-time exercises.\n\nTrack regulatory, contractual, and customer compliance obligations and ensure appropriate control coverage.\n\nAudit & Assurance\nLead all external compliance audits, including planning, evidence collection, auditor coordination, issue resolution, and successful certification.\n\nManage internal control assessments and readiness activities throughout the year.\n\nCoordinate remediation efforts across Engineering, IT, Security, and business teams.\n\nOwn relationships with external auditors and assessment firms.\n\nDevelop reporting and dashboards that communicate compliance posture and audit readiness to leadership.\n\nRisk Management\nPartner with Security leadership to mature enterprise security risk management.\n\nMaintain risk registers and facilitate risk assessments across technology and business functions.\n\nDrive remediation planning and track progress through completion.\n\nSupport third-party risk management activities as required.\n\nCross-Functional Partnership\nBuild strong partnerships with Privacy and Legal to ensure alignment between security, regulatory, and privacy obligations.\n\nPartner with Product, Engineering, Infrastructure, and IT to operationalize security controls.\n\nSupport customer security reviews, due diligence requests, and compliance questionnaires.\n\nProvide practical guidance that enables business growth while maintaining an appropriate risk posture.\n\nLeadership\nLead, coach, and develop a team of two GRC professionals.\n\nEstablish team priorities, operating cadence, and professional development plans.\n\nFoster a culture of accountability, continuous improvement, and operational excellence.\n\nRemain actively involved in execution, serving as a working manager who contributes directly to audits, control implementation, and compliance initiatives.\n\nWhat You Bring\n7+ years of experience in Governance, Risk & Compliance, Information Security, IT Audit, or Security Compliance.\n\nPrevious people management experience leading small, high-performing teams.\n\nHands-on experience owning enterprise compliance programs within SaaS or healthcare technology organizations.\n\nDemonstrated success leading external audits for:\n\nSOC 2 Type II\n\nPCI DSS\n\nHITRUST\n\nGDPR\nFamiliarity with HIPAA and its requirements.\n\nExperience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders.\n\nStrong understanding of security frameworks including NIST CSF, CIS Controls, ISO 27001, and HITRUST.\n\nExperience partnering closely with Privacy and Legal teams on regulatory compliance initiatives.\n\nExperience managing control evidence, remediation programs, and continuous compliance activities.\n\nStrong project management and organizational skills with the ability to manage competing priorities.\n\nExcellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance.\n\nNice to Have\nHealthcare or health technology experience.\n\nExperience with GRC platforms such as Vanta, Drata, OneTrust, or similar.\n\nProfessional certifications such as CISSP, CISA, CRISC, CISM, HITRUST CCSFP, PCI ISA/QSA, or ISO 27001 Lead Auditor.\n\nExperience supporting customer security reviews and enterprise sales due diligence.\n\nWhy This Role Matters\nTrust is one of Fullscript's most important products. As our GRC Manager, you'll help ensure that our security and compliance programs scale alongside the business, enabling innovation while maintaining the confidence of our customers, partners, and regulators. You'll have the opportunity to shape the future of our compliance program, mentor a growing team, and influence security strategy across the organization.\nWhat We Can Offer You\nGenerous PTO and competitive pay\n\nFullscript’s RRSP match program for financial health\n\nFlexible benefits package and workplace wellness program\n\nTraining budget and company-wide learning initiatives\n\nDiscount on Fullscript catalog of products\n\nAbility to work Wherever You Work Well*\n\nOur Wherever You Work Well philosophy means Fullscript teammates get to pick their own office - whether that’s in-office, at home, or a bit of both","description_format":"text","description_chars":5458,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":2,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["E-commerce Platforms","Dietary Supplements"],"lifecycle":[{"event":"open","at":"2026-09-05T10:22:32Z"}],"visa":[{"country":"CA","licensed_sponsor":true,"evidence":"Positions approved through LMIA in 12 months: 2","filings_12m":2,"filings_prev_12m":1,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"High Wage; Global Talent Stream","cap_exempt":false,"checked_at":"2026-10-03T21:10:52+00:00","sources":["ESDC: employers issued a positive LMIA"],"filings_for_role_12m":0}],"liveness":{"score":40,"band":"fade","label":"Fading","p_open":1,"p_active":0.728,"p_room":0.55,"age_days":57,"expected_fill_days":45,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/fullscript-governance-risk-compliance-grc-manager","json_url":"https://alion.io/job/fullscript-governance-risk-compliance-grc-manager.json","meta":{"generated_at":"2026-10-31T04:21:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6051,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9061},"rest":"https://alion.io/mcp/rest/get_company?id=9061"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffullscript-governance-risk-compliance-grc-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffullscript-governance-risk-compliance-grc-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffullscript-governance-risk-compliance-grc-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fullscript-governance-risk-compliance-grc-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffullscript-governance-risk-compliance-grc-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":239616}},{"tool":"search_jobs","arguments":{"company":"fullscript.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":239616},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}