Security Compliance, GRC Engineer

Description

About Mistral

Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms.

We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited.

Role Summary

As a GRC Engineer , you will be at the heart of Mistral’s Governance, Risk, and Compliance (GRC) program. You will design, implement, and maintain the technical and operational frameworks that ensure our organization meets its regulatory, security, and risk management obligations.

Your role will involve collaborating with cross-functional teams to automate compliance processes, monitor risks, and enforce governance policies. You will play a key role in ensuring that our systems, processes, and controls align with industry standards and regulatory requirements.

Responsibilities

• Automate GRC workflows : Design, develop, and deploy automation scripts and tools to streamline compliance monitoring, evidence collection, risk assessments, and control testing.
• Integrate GRC tools with existing systems : Build and maintain integrations between GRC platforms and other enterprise systems (e.g., SIEM, IAM, or ticketing tools) to enable real-time risk and compliance monitoring.
• Develop custom dashboards and reports : Create automated dashboards to provide real-time visibility into compliance status, risk exposure, and control effectiveness for stakeholders.
• Automate control testing and validation : Implement automated control testing for technical controls (e.g., access reviews, patch management, or configuration compliance) to reduce manual effort and improve accuracy.
• Enforce policy-as-code : Embed compliance and security policies directly into cloud and on-premise environments, ensuring consistent enforcement across systems.
• Automate risk assessments : Develop workflows to automate the identification and prioritization of risks, such as integrating vulnerability scanning tools with GRC platforms to flag high-risk assets automatically.
• Streamline audit evidence collection : Automate the gathering and organization of audit evidence (e.g., logs, configuration files, or access records) to support internal and external audits, reducing preparation time and minimizing errors.
• Implement continuous compliance monitoring : Set up automated alerts and triggers for non-compliance events (e.g., unauthorized access, misconfigurations, or policy violations)
• Automate third-party risk management : Build workflows to automate vendor risk assessments, including sending questionnaires, scoring responses, and escalating high-risk vendors for review.
• Enhance incident response with automation : Collaborate with Security teams to automate incident response processes, such as triggering remediation workflows for identified risks or compliance gaps.
• Maintain and optimize GRC tools : Continuously improve GRC platforms by automating routine tasks (e.g., user access reviews, control attestations) and enhancing their scalability and performance.

Requirements

• 5+ years in Governance, Risk, and Compliance (GRC), IT audit, cybersecurity, or a related field.
• Hands-on experience with GRC tools.
• Deep knowledge of compliance frameworks such as ISO 27001, SOC 2, NIST CSF, COBIT, or regulatory requirements like GDPR, NIS2, or HIPAA.
• Proficiency in scripting and automation to streamline GRC processes.
• Strong understanding of IT controls , risk assessment methodologies, and security best practices.
• Experience with SIEM, IAM, or vulnerability management tools .
• Familiarity with cloud security and compliance (e.g., AWS, Azure, or GCP security controls).
• Ability to analyze complex data, identify trends, and develop actionable insights.
• Creative and pragmatic approach to addressing GRC challenges.
• Rigor in managing documentation, controls, and compliance evidence.
• Ability to work effectively with cross-functional teams, including IT, Security, Legal, and Business units.
• Clear and concise written and verbal communication skills, with the ability to explain technical concepts to non-technical stakeholders and vice-versa
• Professional proficiency in English; French proficiency is a plus..
• Certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor/Implementer

Benefits

• We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks.
• For the most up-to-date details on benefits available in your location, please refer to our Benefits page .
• Privacy Policy
• Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy .