Senior Security Engineer – GRC Engineering

This is a fully remote position, open to applicants in India.

📋 Description

• Take ownership of continuous control monitoring from start to finish across identity providers, cloud control planes, code repositories, endpoint management, and ticketing systems.

• Develop alerting mechanisms, escalation processes, and confirmation for remediation of degraded controls.

• Establish a centralized common controls framework adhering to ISO 27001 and SOC 2 standards.

• Align additional frameworks with the common controls framework.

• Gather, timestamp, index, and compile audit-ready evidence as needed.

• Ensure that the evidence system functions within its own controls and maintains appropriate logs.

• Write control validation in code and generate outputs that are both auditor-accepted and actionable for engineers.

• Implement corrections based on pull requests for pipelines, policies, or configurations.

• Collaborate with infrastructure engineering teams on policy as code and evidence generation.

• Define suitable applications of agentic workflows for control mapping, evidence classification, and validation processes.

• Direct the compliance engineering program's strategy, framework priorities, automation initiatives, and engineering resource allocation.

• Enhance metrics related to control health, framework coverage, remediation speed, and overall trends.

• Integrate cyber risk management, risk registers, and exception handling with control telemetry.

• Manage automated asset prioritization to guide risk decisions, control coverage, and remediation sequence.

• Lead the technical aspects of audits, articulating control implementation and evidence production to assessors.

⛳️ Requirements

• A minimum of six years in compliance program leadership and security or compliance engineering, encompassing experience on both the framework side and the development side; equivalent depth is also recognized.

• Proven experience in leading a significant framework through assessment to certification or authorization, such as FedRAMP or a comparable framework, or managing GRC engineering end to end with control telemetry, continuous monitoring, and evidence automation.

• Expertise in strategic framework design and control mapping across various frameworks.

• Recent practical experience with Python and API integration.

• Hands-on involvement with AI integration within the last six months, including validation of tooling outputs.

• Familiarity with ISO 27001 and SOC 2 frameworks.

• Knowledge of FedRAMP 20x, NIS2, DORA, and PCI DSS regulations.

• Understanding of policy-as-code frameworks and cloud enforcement mechanisms.

• Adequate experience with Azure and AWS to determine evidence locations.

• Familiarity with a compliance automation platform.

• Capability to manage an audit calendar and maintain relationships with assessors.

• Proficiency in writing for both auditors and engineers.

• Preferred: experience on the assessor side; knowledge of IRAP or other non-US frameworks; evidence gathering across hosted services and customer-deployed software; previous software or platform engineering experience.

🏝️ Benefits

• Health and wellness initiatives.

• Opportunities for career development.

• Programs that assist employees in pursuing rewarding careers.

• Possibilities for learning and professional growth.

• Commitment to equal employment opportunity and a harassment-free workplace.