Security Governance Engineer - Secure, Build & Change

Description

The company is rebuilding security assurance as an engineering discipline, moving away from spreadsheet-based GRC toward continuous, automated controls built into how software ships.

The team is looking for a Software Engineering role focused on governance, control design, and policy ownership, not hands-on software development.

Apply for no more than 3 roles within 12 months to avoid duplicate effort.

Responsibilities

• Turn enterprise security policies, regulatory obligations, and risk expectations into controls that can be measured and acted on technically.
• Help build a governance framework in which policies and standards are version-controlled, validated, and built into engineering workflows.
• Over time, take ownership of a control family such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.
• Write and maintain security policies, technical standards, and control requirements, and manage their lifecycle through versioning, approvals, exceptions, reviews, and change management.
• Keep policies aligned with architecture, risk appetite, and regulatory obligations.
• Express policy and control requirements in structured, machine-readable form. Work with engineering to turn them into guardrails and validation criteria using OPA/Rego or cloud-native policy frameworks. You do not need to own the implementation, but you review it against policy intent.
• Maintain a common control framework with objectives, owners, and validation criteria, tracing regulation to policy to control to implementation. Define preventive, detective, and compensating controls and support ongoing evaluation of their effectiveness.
• Act as subject-matter expert and point of contact for your assigned domains. Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
• Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams, bringing a governance view to architecture and design discussions.
• Expected outcomes: fast, predictable decisions; clear, consistent, technically actionable requirements; version-controlled, traceable governance; written policies, guardrails, and controls that match; dedicated domain owners who set direction.

Requirements

• 2+ years in information security governance, security engineering, technology risk, or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to convert regulatory and security requirements into measurable control objectives.
• Working knowledge of cloud security on AWS, Azure, or GCP, and of IAM, application, infrastructure, and data security.
• Understanding of preventive and detective control design, risk assessment, and exception management.
• Familiarity with modern development practices, cloud environments, and CI/CD.
• Strong analytical, communication, documentation, and stakeholder management skills.
• Experience with Governance-as-Code or Policy-as-Code, and with policy engines such as OPA/Rego or HashiCorp Sentinel.
• Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
• Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
• Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Conditions

U.S. citizenship or permanent residency is required, and visa sponsorship is not offered for this role.

Work is engineered like software, using version control, code review, CI/CD, and backlogs.

Anything done manually twice is a candidate for automation.

Gaps raise alerts and workflows, and control failures follow defined escalation paths.

You work alongside T&P teams as peers, solving problems together.

Success is measured by risk reduced, effort saved, and audit friction removed.

There are two growth paths: learn engineering if you come from GRC, or learn risk if you come from engineering.