GRC Compliance Analyst – SOC 2 & HIPAA

We are seeking a dedicated GRC Compliance Analyst to lead and enhance our SOC 2 and HIPAA compliance initiatives at our Lahore office. This full-time, on-site role operates on a 6:00 PM to 3:00 AM (PKT) shift and offers the opportunity to collaborate closely with engineering, IT, legal, and leadership teams. The successful candidate will take ownership of compliance programs, ensuring they are seamlessly integrated into our operational and development processes. This position provides significant visibility across the organization and involves hands-on management of audits, risk assessments, and control design.

Key Responsibilities
- Lead the preparation for annual SOC 2 Type II audits, including control testing, evidence collection, and coordination with external auditors.
- Conduct HIPAA security risk assessments and manage remediation efforts through a risk register.
- Design, document, and monitor controls aligned with the Trust Services Criteria and HIPAA safeguards.
- Oversee third-party and vendor risk assessments, including managing Business Associate Agreements (BAAs).
- Develop and maintain security and privacy policies, procedures, and standards.
- Collaborate with engineering teams on access reviews, logging, change management, encryption, and cloud security controls.
- Support incident response activities involving PHI/ePHI, including breach assessment and notification processes.
- Respond to customer security questionnaires and due diligence requests.
- Create and deliver security and HIPAA awareness training programs for employees.

Required Qualifications
- Minimum of 5 years’ experience in compliance, GRC, IT audit, or information security.
- Practical experience supporting SOC 2 Type II audits.
- Solid understanding of HIPAA requirements and protection of PHI/ePHI.
- Proven ability to perform risk assessments and manage remediation plans.
- Strong technical writing skills for policies, procedures, and audit documentation.
- Effective communication skills to explain compliance requirements to both technical and non-technical audiences.

Preferred Qualifications and Benefits
- Professional certifications such as CISA, CISSP, CISM, CRISC, HCISPP, CHPS, or CIPP are highly desirable.
- Experience with HITRUST, ISO 27001, NIST CSF, or PCI DSS frameworks.
- Familiarity with compliance automation tools like Vanta, Drata, Secureframe, or AuditBoard.
- Knowledge of cloud platforms including AWS, Azure, or GCP.
- Background working in healthcare, health technology, or SaaS companies serving healthcare clients.

The monthly salary range for this position is Rs100,000 to Rs250,000. Candidates must be based in Lahore and able to work on-site. Applicants will be asked to provide their expected compensation during the application process.