Headway
Senior Governance Risk and Compliance (GRC) Analyst
Job Summary
This role focuses on building and maintaining security and privacy frameworks within Headway, ensuring compliance with various certifications and managing risk signals throughout the company's operations. The position involves partnering with cross-functional teams, supporting security audits, incident response, vulnerability management, and operational security tasks. The ideal candidate has over five years of experience in governance, risk, and compliance, with strong technical security expertise and a collaborative approach. The role is remote, offering a comprehensive benefits package and opportunities to contribute to improving mental healthcare accessibility.
Required Skills
Benefits
Job Description
Headway’s mission is a big one – to build a new mental health care system everyone can access. We’ve built technology that helps people find great therapists with the first software-enabled national network of providers accepting insurance.
1 in 4 people in the US have a treatable mental health condition, but the majority of providers don’t accept insurance, making therapy too expensive for most people. Headway is building a new mental healthcare system that everyone can access by making it easy for therapists to accept insurance and scale their practice.
Headway was founded in 2019. Since then, we’ve grown into a diverse, national network of over 45,000 mental healthcare providers across all 50 states who run their practice on our software and have served over 1 million patients. We’re a Series D company with over $325m in funding from a16z (Andreessen Horowitz), Accel, GV (formerly Google Ventures), Spark Capital, Thrive Capital, Forerunner Ventures and Health Care Service Corporation.
We want your time here to be the most meaningful experience of your career. Join us, and help change mental healthcare for the better.
About Trust at Headway:
The Trust team at Headway is focused on security and privacy for all of Headway’s customers - therapists, patients, and payers (ex: insurance companies and health systems). As an early member on the team, you’ll have the unique opportunity to be the builder and driver of our dedicated, in-house security engineering efforts.
In this role, you will be expected to build, extend, and connect Headway risk and compliance processes that scale with the business. You will partner closely with members of Security, IT, and Headway Engineering teams to ensure Headway prioritizes the most important risks and exceeds compliance expectations.
What you’ll do at Headway:
- Building + maintaining a Common Controls Framework - align and continuously monitor shared compliance and risk controls across different certifications and customer requirements
- Coordinate security or privacy certification audits (e.g. SOC2, HiTrust, GDPR/CCPA, etc.) w/ external firms and Engineering and Security teams
- Partner with Trust and Engineering teams to identify risk signals - Collaborate with Trust and Engineering teams to recognize and flag potential risk signals during all stages of Headway event’s lifecycle.
- Assist in ongoing security operations: You will be part of the security and privacy team and have responsibilities to assist in incident response, vulnerability management, penetration testing, security reviews, and other operational tasks to ensure that our security program is operating at a world-class level.
Tools we use:
- Languages: Python 3, TypeScript
- Libraries: FastAPI, SQLAlchemy, React/Remix, Celery
- Datastores: PostgreSQL, Snowflake
- Infrastructure: AWS (ECS, S3, RDS), Cloudflare, Kafka
Infrastructure Security: Wiz
- Monitoring: Datadog, PagerDuty
- Version Control: Github
- Vulnerability Management: Semgrep
You’ll be great for this role if you have:
- Have 0 → 1 GRC experience: You have 5+ years experience alongside security and/or software engineering roles in startup or growth stage teams with a demonstrated history of delivering on governance, risk, and compliance goals.
- Strong cross-functional experience: You love partnering with other teams to help both teams achieve their goals.
- Strong technical depth and breadth: You have technical experience with secure product platforms. You want to understand security systems and improve process efficiency.
- Thrive in ambiguity: You love tackling ambiguous problems in a fast-paced environment with an optimistic and energizing attitude.
- Innovation at Scale: You seek opportunities to lead the industry in implementing the latest security and privacy technologies.
- Results driven: You care deeply about creating impact and driving results for Headway’s business.
- Mission driven: You are motivated by Headway’s mission, increasing access to high quality mental health care.
Our interview process
After you apply to Headway, here are some details of what to expect during the interview process.
- Initial screen: You’ll connect with someone in recruiting so you can learn more about the team, Headway’s mission and exciting growth, and we can get a better idea of your background.
- First round: You'll meet with the hiring manager to hear more about the role and team, and further illustrate the depth of your experience as it relates to the requirements of this specific role.
- Final rounds: You’ll meet several more team members for technical and non-technical interviews, including our CISO who this role reports to, and leave with a fuller picture of what it’s like to work at Headway.
- References and the Offer: Our favorite part of the process! We'll send over all of the details, including specifics on employee equity, and congratulatory messages from excited future team members!
Compensation and Benefits:
The expected base pay range for this position is $163,200 - $192,000, based on a variety of factors including qualifications, experience, and geographic location. In addition to base salary, this role may be eligible for performance-based variable compensation and an equity grant, depending on the position and level.
We are committed to offering a comprehensive and competitive total rewards package, including robust health and wellness benefits, retirement savings, and meaningful ownership opportunities through equity. Compensation decisions are made holistically, ensuring fairness and alignment with market benchmarks while recognizing individual contributions and potential.
- Benefits offered include:
- Equity compensation
- Medical, Dental, and Vision coverage
- HSA / FSA
- 401K
- Work-from-Home Stipend
- Therapy Reimbursement
- 16-week parental leave for eligible employees
- Carrot Fertility annual reimbursement and membership
- 13 paid holidays each year as well as a Holiday Break during the week between December 25th and December 31st
- Flexible PTO
- Employee Assistance Program (EAP)
- Training and professional development
#LI-EM1
We believe a team's strength is in its people, and we cannot achieve this mission without a team that reflects the diversity of this problem – across race, ethnicity, gender, sexuality, age, national origin, religion, family status, disability, military status, and experience.
Headway is committed to the full inclusion of all qualified individuals. As part of this commitment, Headway will ensure that persons with disabilities are provided with reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or receive other benefits and privileges of employment, please inform the recruiter when they contact you to schedule your interview.
Headway employees work remotely across the US, with the option to work from offices in New York City, San Francisco and Seattle. Headway participates in E-Verify. To learn more, click here.
Headway
A platform connecting patients with mental health providers, simplifying access to therapy and psychiatric care.
See more jobsSafe Remote Job Search Tips
Verify Employer Thoroughly
Research the company's identity thoroughly before applying. Check for a professional website with contacts, active social media, and LinkedIn profiles. Verify details across platforms and look for reviews on Glassdoor or Trustpilot to confirm legitimacy.
Never Pay to Get a Job
Legitimate employers never require payment for applications, training, background checks, or equipment. Always reject upfront payment requests or demands for bank details, even if they claim it's for purchasing necessary work gear on your behalf.
Safeguard Your Personal Information
Protect sensitive data like SSN, bank details, or ID copies. Share this only after accepting a formal, written job offer. Ensure it's submitted via a secure company system or portal, never through insecure channels like standard email attachments.
Scrutinize Communication & Interviews
Watch for communication red flags: poor grammar, generic emails (@gmail), vague details, or undue pressure. Be highly suspicious of interviews held only via text or chat apps; legitimate companies typically use video or phone calls.
Beware of Unrealistic Offers
If an offer's salary or benefits seem unrealistically high for the work involved, be cautious. Research standard pay for similar roles. Offers that appear 'too good to be true' are often scams designed to lure you into providing information or payment.
Insist on a Formal Contract
Always secure and review a formal, written job offer or employment contract before starting work or sharing final personal details. Ensure it clearly defines your role, compensation, key terms, and conditions to avoid misunderstandings or scams.