GRC Engineer

This is a fully remote position, open to applicants in North America.

📋 Description

• Take full responsibility for SOC 2 Type II and HIPAA compliance from start to finish, encompassing scoping, control design, evidence collection, auditor walkthroughs, and remediation efforts.

• Define and lead the implementation of the next compliance framework, likely ISO 27001, in accordance with customer requirements.

• Develop and sustain integrations that feed the GRC platform from various cloud providers, SaaS applications, and internal systems.

• Transform controls into continuous monitoring using policy-as-code, configuration drift detection, and a control-failure pipeline.

• Manage the vendor security review program from intake through to periodic re-assessment.

• Oversee the security questionnaire and trust center workflow.

• Maintain the risk register and perform risk assessments that yield documented decisions.

• Integrate compliance requirements into the SDLC and change management via tooling.

• Minimize the manual effort needed to successfully navigate quarterly audits.

⛳️ Requirements

• A minimum of 5 years of experience in security, with a proven track record of creating automation for a GRC or compliance program.

• Technical leadership in at least one SOC 2 Type II or ISO 27001 audit.

• Proficient in coding and effectively utilizing LLMs without compromising quality.

• Hands-on experience with the API of a GRC platform.

• Expertise in Cloud IAM and configuration for at least one provider; GCP is preferred.

• Capability to identify sufficient evidence and present an automated test to an auditor convincingly.

• Ability to define, prioritize, and implement tasks independently within a small security engineering team.

• Strong writing skills necessary for policies, control narratives, and responses to questionnaires.

• Experience in an all-remote company is a plus.

• Production experience in deploying LLM or agent-based workflows for compliance tasks is advantageous.

• Background in a developer-tools company is a plus.

🏝️ Benefits

• Competitive salary.

• Stock option plan / equity ownership.

• Comprehensive health insurance.

• Choice of home office equipment.

• Unlimited vacation policy with a recommendation of 25 days per year.

• National holidays based on the country of residence.

• A diverse and inclusive team distributed globally.