GRC Engineer

This is a fully remote position, open to applicants in Mexico.

📋 Description

• Oversee multiple control frameworks and align controls with established standards.

• Monitor control ownership and overall health.

• Collaborate with control owners to identify and resolve control deficiencies.

• Define the scope for both internal and external audits.

• Partner with auditors from the initial meeting through to the finalization of the audit.

• Gather and evaluate evidence across frameworks for compliance and traceability.

• Track audit findings and ensure remediation is completed.

• Conduct security assessments of third-party vendors.

• Monitor vendor remediation actions and keep the vendor inventory up to date.

• Create, revise, and sustain security policies, procedures, and standards.

• Respond to customer security inquiries and requests.

• Assist in customer audits by providing necessary compliance documentation.

• Manage the risk register, including tracking exceptions, acceptance, and expiration.

• Develop and maintain integrations and automation for evidence collection and control oversight.

• Collaborate with engineering teams to ensure technical controls align with business needs.

• Report directly to the Director of Security.

• Occasional travel of 10–25% may be necessary for team meetings, training, or company events.

⛳️ Requirements

• Minimum of 5 years of experience in GRC, security compliance, IT audit, or risk management, preferably in a SaaS or cloud environment.

• Proficient understanding of SOC 2, ISO 27001, and NIST frameworks, including control mapping.

• Experience in supporting external audits and assessments, including scoping, collecting evidence, conducting walkthroughs, and remediating findings.

• Background in performing risk assessments, maintaining a risk register, and evaluating third-party vendor security practices.

• Knowledge of compliance automation or GRC tools.

• Experience in implementing security automation, including the use of scripting or workflow tools for evidence collection and control monitoring.

• Familiarity with cloud infrastructure and security controls such as access management, logging, encryption, and change management.

• Excellent written and verbal communication skills, with the ability to convey control requirements and risks to both technical and non-technical teams while managing multiple deadlines.

• Experience with AI Governance framework is a plus.

• Previous experience in HIPAA or FedRAMP-regulated industries is desirable.

• Familiarity with working within globally distributed teams is a plus.

• CISA, CRISC, or Security+ certifications are a plus.

• Must be located in Mexico.

🏝️ Benefits

• Opportunities for mentoring and career development.

• An inclusive, equitable, and transparent hiring process.

• Employer-managed employment terms and benefits for EOR arrangements (where applicable).