GRC Engineer – Governance Risk and Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and uphold repeatable processes for testing and monitoring security, technology, and application controls.

• Establish testing protocols, evidence requirements, frequencies, expected outcomes, and criteria for exceptions.

• Conduct control testing and document the procedures, results, and conclusions.

• Detect control failures, process shortcomings, control drift, evidence insufficiencies, and associated risks.

• Examine deficiencies and collaborate with control owners on remediation or compensating controls.

• Automate evidence gathering, control testing, and ongoing monitoring through queries, scripts, APIs, integrations, and GRC tools.

• Extract and verify evidence from applications and source systems for audits, assessments, and control testing.

• Assist with SOC 2, ITGC/SOX readiness, NYDFS, and other compliance efforts, including walkthroughs and auditor follow-ups.

• Maintain audit-ready evidence and testing documentation, and retest controls that have been remediated.

• Convert regulatory, audit, and security requirements into actionable controls and testing procedures.

• Aid in technical risk evaluations, remediation planning, business continuity and disaster recovery initiatives, privacy, third-party risk, governance, and regulatory compliance projects.

• Recognize opportunities to leverage automation, AI, and other technologies to enhance GRC processes.

• Collaborate with business and technical teams on assessments, remediation actions, and GRC priorities.

⛳️ Requirements

• Over 4 years of relevant experience in IT audit, GRC, information security, security assurance, technology risk, or related fields.

• Practical experience in testing technical security and technology controls, as well as supporting SOC 2, SOX/ITGC, ISO 27001, NYDFS, NIST, or similar audits or assessments.

• Comprehensive understanding of identity and access management, logging and monitoring, vulnerability and endpoint management, cloud security, change management, SDLC, and backup and recovery.

• Capability to retrieve, interpret, and validate technical evidence, including configurations, access data, logs, vulnerability results, change records, and system-generated reports.

• Proficient in SQL, KQL, PowerShell, or comparable tools.

• Ability to assess control design and operation, identify deficiencies and root causes, and suggest remediation or compensating controls.

• Excellent analytical, communication, and professional judgment skills.

• Ability to work independently with technical teams, auditors, control owners, and stakeholders.

• Must have authorization to work in the United States without current or future visa sponsorship.

• Preferred: Experience with Azure, Entra ID, Microsoft 365, SIEM/SOAR, endpoint, vulnerability management, and cloud security tools.

• Preferred: Experience in continuous control monitoring, automated evidence collection, APIs, scripting, or integrations.

• Preferred: Familiarity with GRC/IRM platforms such as Optro/AuditBoard.

• Preferred: Background in insurance, financial services, fintech, or regulated industries.

• Preferred: Knowledge of NYDFS 23 NYCRR Part 500, NAIC, PCI DSS, or NIST CSF.

• Preferred: Certifications such as CISA, CRISC, CISSP, CISM, Security+, or similar credentials.

🏝️ Benefits

• 100% remote work environment.

• Health insurance provided through Aetna (100% of premiums covered).

• Dental and vision insurance offered through Guardian (100% of premiums covered).

• Basic life insurance (100% of premiums covered).

• Flexible spending account (FSA) or health savings account (HSA).

• 401K plan with up to 4% matching and immediate vesting.

• Flexible PTO policy allowing up to 4 weeks in the first 12 months.

• Typically up to 5 weeks of PTO for each calendar year thereafter.

• 12 company-paid holidays annually.

• Annual stipend for continuing education.