Senior GRC Engineer – Security Engineer I

This is a fully remote position, open to applicants in Washington.

📋 Description

• Take ownership of automation controls for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks.

• Design and implement automated evidence collection and continuous control monitoring across cloud, identity, endpoint, and SaaS platforms.

• Represent controls, control tests, and cross-framework mappings as version-controlled code.

• Convert compliance requirements into technical control logic, workflows, and integrations.

• Collaborate with engineering, IT, and security teams to incorporate controls into current systems and pipelines.

• Engage in architecture and design reviews, defining control requirements as part of acceptance criteria.

• Create self-service compliance experiences, guardrails, paved-road patterns, and tool-integrated compliance feedback.

• Assess control effectiveness against pertinent risks and suggest alternative controls when necessary.

• Assist in full SOC 2, ISO, and HIPAA audit cycles, including evidence requests, maintenance of the evidence library, auditor follow-ups, and tracking remediation.

• Develop dashboards and reporting for control health, evidence freshness, and audit preparedness.

• Minimize duplicate evidence gathering through cross-framework control mapping.

• Identify recurring control failures or outdated evidence and address underlying process, tooling, or ownership issues.

• Collaborate with the GRC Team Lead and SATellite engineering to enhance the internal GRC platform.

⛳️ Requirements

• Over 4 years of experience in GRC engineering, security engineering, compliance automation, or IT audit support, with direct ownership of at least one complete certification cycle (SOC 2, ISO 27001, or similar).

• Practical, hands-on experience with GRC or compliance automation platforms (such as Vanta, Drata, Secureframe, or a custom equivalent), including integration configuration and evidence pipeline building.

• Knowledge of cloud security fundamentals (AWS/GCP/Azure IAM, logging, encryption) and their relationship to control requirements.

• Strong understanding of SOC 2, ISO 27001, ISO 27017/27701, and HIPAA control requirements.

• Ability to align controls across frameworks to prevent duplicate evidence efforts.

• Proficiency in scripting or light development (Python, JavaScript, or similar) to create integrations, automate evidence retrieval via API, or enhance GRC tools.

• Excellent written communication skills.

• Stakeholder-focused mindset aimed at simplifying compliance for engineers.

• Capability to trace control failures or audit findings to their root causes and facilitate enduring fixes across teams.

• Legally authorized to work in the U.S. on an ongoing basis.

🏝️ Benefits

• Employer-subsidized medical, vision, and dental coverage for full-time employees.

• 401k match to assist you in saving for your future (50% of your contribution up to the first 6% of your eligible pay).

• Monthly stipend to enhance your work and productivity.

• Flexible Time Away Program, along with Sick Time Off.

• U.S. employees are automatically enrolled in Smartsheet-sponsored life insurance, short-term, and long-term disability plans.

• U.S. employees receive 12 paid holidays each year.

• Up to 24 weeks of parental leave.

• Personal paid volunteer day to support our community.

• Opportunities for professional development, including access to Udemy online courses.

• Company-funded perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account.

• Teleworking options from any registered U.S. location (role-specific).

• Market-competitive incentive opportunities.