--- title: 'Governance, Risk & Compliance (GRC) Manager at Fullscript' canonical: 'https://feeny.ai/job/governance-risk-compliance-grc-manager-fullscript-ottawa-33je9cd7zf9n' type: 'job' last_seen: '2026-09-07' --- # Governance, Risk & Compliance (GRC) Manager at Fullscript - **Company:** Fullscript - **Location:** Ottawa, Canada - **Employment:** full-time - **Work type:** remote - **Posted:** 2026-09-02 - **Last confirmed live:** 2026-09-07 - **Apply:** https://jobs.lever.co/fullscript/414a5288-7aac-4d15-af98-2963d5aa2a88 ## Job description ## About Fullscript We’re an industry-leading health technology company on a mission to help people get better. We started in 2011 with one simple idea. Make it easier for practitioners to access the products they trust so they can deliver better care. That simple idea grew into a platform that powers every part of care. Today, more than 125,000 practitioners use Fullscript for clinical insights, lab interpretations, patient analytics, education, and access to high-quality supplements. Over 10 million patients rely on Fullscript to stay connected to their care plans and follow through on treatment. We build tools that make care smarter and more human. Tools that save time, simplify decisions, and help practitioners stay closely connected to the people they care for. When everything they need is in one place, they can focus on what matters most: helping people get better. This is your invitation. Bring your ideas, your grit, and your care for people. Join us and shape the future of care. The Opportunity We're looking for an experienced Governance, Risk & Compliance (GRC) Manager to lead and mature Fullscript's security compliance program. This is a hands-on leadership role responsible for driving our governance, risk, and compliance strategy while directly managing a team of two GRC professionals. You'll own our security compliance program across multiple frameworks, including SOC 2 Type II, PCI DSS, and HITRUST, ensuring we remain continuously audit-ready while scaling our controls alongside the business. You'll lead internal and external audits, partner closely with Security, Engineering, Infrastructure, Privacy, Legal, Product, and IT, and help translate regulatory and customer requirements into practical, scalable security practices. This role is ideal for someone who enjoys balancing strategic program ownership with day-to-day execution and who thrives in highly collaborative, fast-growing SaaS environments. ## What You'll Do Governance & Compliance Own and evolve Fullscript's Governance, Risk & Compliance program. Maintain and continuously improve compliance across SOC 2 Type II, PCI DSS, and HITRUST. Develop and maintain policies, standards, procedures, and control documentation. Ensure compliance activities are embedded into operational processes rather than point-in-time exercises. Track regulatory, contractual, and customer compliance obligations and ensure appropriate control coverage. Audit & Assurance Lead all external compliance audits, including planning, evidence collection, auditor coordination, issue resolution, and successful certification. Manage internal control assessments and readiness activities throughout the year. Coordinate remediation efforts across Engineering, IT, Security, and business teams. Own relationships with external auditors and assessment firms. Develop reporting and dashboards that communicate compliance posture and audit readiness to leadership. Risk Management Partner with Security leadership to mature enterprise security risk management. Maintain risk registers and facilitate risk assessments across technology and business functions. Drive remediation planning and track progress through completion. Support third-party risk management activities as required. Cross-Functional Partnership Build strong partnerships with Privacy and Legal to ensure alignment between security, regulatory, and privacy obligations. Partner with Product, Engineering, Infrastructure, and IT to operationalize security controls. Support customer security reviews, due diligence requests, and compliance questionnaires. Provide practical guidance that enables business growth while maintaining an appropriate risk posture. Leadership Lead, coach, and develop a team of two GRC professionals. Establish team priorities, operating cadence, and professional development plans. Foster a culture of accountability, continuous improvement, and operational excellence. Remain actively involved in execution, serving as a working manager who contributes directly to audits, control implementation, and compliance initiatives. ## What You Bring 7+ years of experience in Governance, Risk & Compliance, Information Security, IT Audit, or Security Compliance. Previous people management experience leading small, high-performing teams. Hands-on experience owning enterprise compliance programs within SaaS or healthcare technology organizations. Demonstrated success leading external audits for: SOC 2 Type II ## PCI DSS ## HITRUST Familiarity with HIPAA and its requirements. Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders. Strong understanding of security frameworks including NIST CSF, CIS Controls, ISO 27001, and HITRUST. Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives. Experience managing control evidence, remediation programs, and continuous compliance activities. Strong project management and organizational skills with the ability to manage competing priorities. Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance. ## Nice to Have Healthcare or health technology experience. Experience with GRC platforms such as Vanta, Drata, OneTrust, or similar. Professional certifications such as CISSP, CISA, CRISC, CISM, HITRUST CCSFP, PCI ISA/QSA, or ISO 27001 Lead Auditor. Experience supporting customer security reviews and enterprise sales due diligence. ## Why This Role Matters Trust is one of Fullscript's most important products. As our GRC Manager, you'll help ensure that our security and compliance programs scale alongside the business, enabling innovation while maintaining the confidence of our customers, partners, and regulators. You'll have the opportunity to shape the future of our compliance program, mentor a growing team, and influence security strategy across the organization. ## What We Can Offer You Generous PTO and competitive pay Fullscript’s RRSP match program for financial health Flexible benefits package and workplace wellness program Training budget and company-wide learning initiatives Discount on Fullscript catalog of products Ability to work Wherever You Work Well* Our Wherever You Work Well philosophy means Fullscript teammates get to pick their own office — whether that’s in-office, at home, or a bit of both 🐶🏡 ## Compensation range The salary range for this role is between $140,000 and $165,000 CAD. Fullscript shares salary ranges to support transparency and help candidates make informed decisions. The range shown reflects base salary only. Additional incentives, perks, and benefits may be available as part of Fullscript’s total rewards package. Final base salary depends on experience, skills, and location. We review pay regularly to stay aligned with market data and internal equity. Benefits and total rewards may vary by region. ## Why Fullscript Great work happens when people feel supported, trusted, and inspired. At Fullscript, we stay curious and keep finding smarter ways to make care better. We grow together, take on new challenges, and focus on impact. We put people first, work as a team, and leave egos at the door. What to Know Before You Apply We’re grateful for the interest in joining Fullscript. To make sure your application reaches our hiring team, please apply directly through our careers page. A quick note: Due to the high volume of applications, we’re not able to respond to phone or email inquiries about application status. If there’s a match, our team will reach out directly. Fullscript is an equal opportunity employer committed to creating an inclusive workplace. Accommodations are available upon request at accommodations@fullscript.com. All offers are contingent on successful background checks conducted in compliance with federal, state, and provincial laws. We use AI tools to support parts of the hiring process, including screening and reviewing responses. Final hiring decisions are always made by people and follow all applicable privacy and employment laws in Canada and the U.S. Learn More www.fullscript.com @fullscriptHQ on instagram Let’s make healthcare whole ## About Fullscript ## Company Overview - **One-liner**: Fullscript is a provider-led healthcare platform that empowers clinicians to deliver personalized, integrative care through supplement management, lab testing, and practice tools. - **Entity Type**: Private (Series C stage based on total funding of $273.1M) - **Headquarters**: Ottawa, Ontario, Canada - **Founded**: 2011 - **Founders**: Not publicly listed on main sources; the company was founded in 2011. ## Core Business - **Primary industry**: Healthcare Technology (HealthTech) / Integrative Medicine - **Target customers**: B2B – licensed healthcare providers (naturopaths, functional medicine doctors, chiropractors, nutritionists, MDs) and their patients (B2B2C model) - **Mission statement**: "Make care easier for providers to deliver and patients to receive" by building a healthcare platform that amplifies a provider's reach and expertise, rather than replacing human connection with algorithms. ## Products & Services - **Supplement Management Platform**: The core product – a digital formulary and e-commerce platform that allows providers to prescribe, manage, and auto-ship over 20,000+ vetted supplement products to patients. Includes wholesale ordering integration (via Natural Partners) and patient-facing dispensaries. - **Fullscript Assist**: A HIPAA-compliant AI assistant that reads lab results, surfaces evidence-based recommendations, and drafts personalized treatment plans in minutes. - **Lab Testing (via Rupa Health acquisition)**: Integrated lab ordering and result management, connecting diagnostics to treatment planning. - **Fullscript Journeys**: Automated patient onboarding and care plan delivery tool with provider branding and clinical guidance built in. - **Quality Assurance Program**: Annual cGMP certification verification for all brands, plus independent blind purity/potency testing of 250 products per quarter by end of 2026. ## Market Standing - **Valuation**: Not publicly disclosed - **Key Metrics**: - **Annual Revenue**: $450M (per LinkedIn data) - **Total Funding**: $273.1M across 4 rounds - **Provider Base**: 125,000+ licensed clinicians - **Patient Reach**: 10+ million patients - **Headcount**: 609 employees (+23.6% YoY growth, +148 people) - **Notable Investors/Partners**: Kayne Partners (Series B, $25M in 2019), HGGC and Snapdragon Capital Partners ($240M strategic growth investment in 2021). Acquired Emerson Ecologics in 2021 and Rupa Health in October 2024. - **Growth Signals**: 23.6% headcount growth year-over-year; strategic acquisition of Rupa Health (Oct 2024) to add lab testing capabilities; expansion of AI-powered clinical tools (Fullscript Assist); physical distribution centers in Phoenix, Lancaster, Riverside, Colonial Heights, and Lenexa. ## Competitive Advantages - **Provider-led model**: Unlike many digital health platforms that attempt to replace clinicians, Fullscript builds tools to amplify provider expertise, creating strong stickiness with the 125,000+ practitioners who rely on it. - **Vetted catalog and quality assurance**: A rigorous, independently-verified supplement quality program (cGMP certification, blind testing) that builds trust with clinicians and patients. - **Integrated ecosystem**: Combines supplement dispensing, lab testing, AI-assisted planning, and patient engagement in a single platform – reducing fragmentation for practitioners. - **15 years of prescribing data**: Real-world outcomes data from millions of patients and thousands of clinicians provides a unique network effect and clinical intelligence moat. ## Strategic Focus - **AI-powered clinical tools**: Rolling out Fullscript Assist to reduce manual work for providers and accelerate personalized care planning. - **Diagnostics integration**: Deepening the lab testing and biomarker analysis capabilities following the Rupa Health acquisition. - **Expanding the care journey**: Moving beyond supplements into full-spectrum practice management (lifestyle, adherence, patient engagement). - **National distribution**: Operating five distribution centers across the US to ensure rapid, reliable delivery of supplements to patients. ## Why Work Here - **Culture**: Emphasizes "Wherever You Work Well" – a flexible hybrid model where teammates choose in-office, remote, or a mix. Physical hubs in Ottawa (Constitution Square) and virtual hubs across Canada and the US. - **Perks & Benefits**: - Tailored medical, dental, vision, and HSA/FSA benefits - Stock option incentives - RRSP and 401k matching - Flexible PTO plus paid public holidays - Employee discounts on the entire Fullscript catalog - Office amenities: fitness facilities, ping pong, games, unlimited snacks and caffeinated beverages - **Community & Events**: Town halls, hackathons, "Fullhouse" events, offsites, teams, and clubs. Employee Resource Groups (ERGs) and a DEIB Council. - **Engineering Culture**: Emphasis on using AI to amplify human capabilities; 21 jobs available at time of research (including Compliance Lead and likely engineering roles). - **Global Team**: Employees across 7 countries (Canada, US, Philippines, Germany, UK, and others). ## Sources 1. [fullscript.com](https://fullscript.com/about) 2. [fullscript.com](https://fullscript.com/careers) 3. [fullscript.com](https://fullscript.com/) 4. [linkedin.com](https://linkedin.com/company/fullscript) ## Other roles at Fullscript - [Senior Warehouse Operations Manager](https://feeny.ai/job/senior-warehouse-operations-manager-fullscript-ashland-zr5t0wwbeh0z) — Ashland, VA - [Staff Engineer](https://feeny.ai/job/staff-engineer-fullscript-ottawa-hpma1h4cht2w) — Ottawa, Canada - [AI Enablement Specialist](https://feeny.ai/job/ai-enablement-specialist-fullscript-toronto-76bv0q3fkrn8) — Toronto, Canada - [Engineering Manager, Patient Experience](https://feeny.ai/job/engineering-manager-patient-experience-fullscript-ottawa-ae7kx7shfp60) — Ottawa, Canada - [Warehouse Associate (Phoenix, AZ)](https://feeny.ai/job/warehouse-associate-phoenix-az-fullscript-phoenix-mvjqh2y63mck) — Phoenix, AZ - [Warehouse Associate (Ashland, VA)](https://feeny.ai/job/warehouse-associate-ashland-va-fullscript-ashland-82nh6c8hbvth) — Ashland, VA - [Accounts Payable Manager](https://feeny.ai/job/accounts-payable-manager-fullscript-ottawa-drn0a15adh7y) — Ottawa, Canada - [Engineering Manager, Ecommerce](https://feeny.ai/job/engineering-manager-ecommerce-fullscript-ottawa-7feaq3k64qez) — Ottawa, Canada - [Sr Lead, Benefits](https://feeny.ai/job/sr-lead-benefits-fullscript-ottawa-b6byzf91r34t) — Ottawa, Canada - [Financial Planning & Analysis Manager](https://feeny.ai/job/financial-planning-analysis-manager-fullscript-ottawa-yche084saf5h) — Ottawa, Canada