Security Engineer, GRC

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Develop and expand GRC programs that support commercial audits, federal compliance, security risk management, vendor risk, policy management, and customer trust.

• Oversee GRC initiatives that encompass commercial compliance, federal compliance, security risk, vendor risk, policy management, and customer trust.

• Assist with planning, preparation for assessments, remediation efforts, and ongoing monitoring for FedRAMP, CMMC, NIST 800-53, and related programs.

• Collaborate with control owners, Security, Engineering, Legal, Privacy, auditors, assessors, and business stakeholders.

• Collect evidence, track actions, and address compliance and security deficiencies.

• Establish and enhance methods for evidence generation, validation, requirement mapping, storage, and source traceability.

• Supervise control health, evidence currency, configuration drift, exceptions, and remediation progress.

• Create or configure automated and AI-assisted workflows to minimize manual efforts and enhance the reliability of compliance and risk processes.

• Maintain project plans, action trackers, risk logs, documentation, and status updates.

• Contribute to consistent team practices and knowledge sharing.

• Recognize opportunities to enhance GRC workflows through AI and convert valuable experiments into practical, dependable solutions.

⛳️ Requirements

• Minimum of three years of experience in security, compliance, risk, audit, GRC, program management, or a related technical field.

• Proven experience managing moderately complex, cross-functional compliance or security projects.

• Familiarity with implementing security or compliance frameworks such as SOC 2, ISO 27001, NIST 800-53, CMMC, FedRAMP, PCI DSS, or similar standards.

• Experience with FedRAMP or similar federal compliance programs.

• Knowledge of authorization boundaries, assessment preparation, POA&Ms, continuous monitoring, 3PAO coordination, or remediation.

• Capability to translate framework requirements into control activities, policies, procedures, test cases, evidence requirements, and operational workflows.

• Experience with GRC platforms like Drata, Tines, Vanta, ServiceNow, Archer, LogicGate, Secureframe, or similar tools.

• Proficiency in using APIs, scripts, webhooks, ticketing workflows, and cloud or identity integrations.

• Regular utilization of AI in daily tasks and experience experimenting with or setting up AI-assisted workflows for GRC, security, risk, or compliance tasks.

• Understanding of AI validation, human judgment, reliable controls, and the appropriate review of AI-generated outputs.

• Must already possess legal authorization to work in the United States or Canada; 1Password does not provide work authorization, relocation assistance, or visa sponsorship/transfer.

• Successful candidates must undergo a background check.

🏝️ Benefits

• Health benefits.

• Dental benefits.

• 401(k) / retirement matching program.

• RRSP for Canada-based roles.

• Generous paid time off (PTO).

• Equity grant / RSU program for most employees.

• Incentive programs where applicable.

• Maternity and parental leave top-up programs.

• Free 1Password account.

• Paid volunteer days.

• Peer-to-peer recognition through Bonusly.

• Remote-first work environment.

• Travel for in-person engagements, including offsites, team meetings, and customer/industry events.

• Accommodation available upon request during recruitment.