Senior GRC Engineer

Description

The team is Security Trust & Risk, which covers governance, risk, compliance, vendor and customer assurance, and business continuity across the company's platform ecosystem.

The company builds AI-assisted scenario planning software used by more than 2,400 global companies, including Fortune 50 firms.

This is an early role in a function still being built. You will help create the technical base that lets GRC work as an engineering practice, replacing point-in-time audits and risk scores with continuously measured signals that guide priorities and important decisions.

You sit between GRC and the rest of the business. You can discuss architecture with engineers, then speak with customers and turn security requirements into practical steps that build trust.

The goal is for controls, monitoring and routine processes to run all year, so audit evidence is a by-product rather than a last-minute scramble.

Part of the job is making clear why each control exists, whether it comes from a compliance duty, a customer request or a new threat, not only how it works.

Over time you will learn how the product and platform work, how infrastructure and internal systems are run, and where security controls sit in daily operations.

Responsibilities

• Advise technical and non-technical teams as a GRC partner, turning compliance, governance and risk requirements into implementation details and taking part in architecture and design discussions.
• Use the cross-framework control crosswalk to find overlapping requirements, so engineers build one shared control instead of a separate fix for each certification.
• Join customer security and compliance conversations that need technical depth, such as platform architecture, control implementation and how obligations are met.
• Build the processes, scripts, workflows and tooling that make controls part of daily work, and automate keeping compliance and risk data current instead of refreshing it before audits.
• Write knowledge-sharing material, documentation and diagrams that explain the reasoning behind a control, whether it stems from a compliance obligation, a customer request or an emerging threat.
• Work with Risk Management to build risk identification, scoring and monitoring into routine operations, support continuous monitoring (ConMon) across Compliance, Risk and Governance, and deepen your knowledge of the product and platform.

Requirements

• 6+ years in security engineering, GRC, DevSecOps or a closely related technical role, with hands-on work on compliance or regulatory frameworks.
• Comfortable writing scripts or light code in Python, Bash or similar to automate evidence collection, reporting or monitoring.
• Working knowledge of at least two of: ISO 27001 and its extensions (27017, 27018, 27701, 42001), SOC 1/2, Cyber Essentials or similar, including use of a cross-framework crosswalk to cut duplicate work.
• Able to build and read system and data-flow diagrams, and proficient with a GRC or risk platform such as Drata, Vanta, Hyperproof, Archer, OneTrust, ServiceNow GRC or similar.
• Experience turning compliance and risk requirements into guidance engineering teams can act on.
• Comfortable engaging with engineering teams and customers on technical topics, and building process and tooling in a growing function.
• Nice to have: hands-on experience applying AI or LLM tools to a real operational workflow, such as automating a repetitive review step or summarising evidence for a control.
• Nice to have: familiarity with OSCAL or similar machine-readable control languages.
• Nice to have: experience with quantitative or semi-quantitative risk scoring methods such as FAIR.
• Nice to have: experience with FedRAMP and/or HIPAA/HITRUST, especially across more than one.
• Nice to have: experience supporting external audits or assessments as a technical point of contact.
• Nice to have: certifications such as CISA, CISSP or ISO 27001 Lead Implementer.

Conditions

Based in the New York office on a hybrid schedule, with in-person attendance twice a week.

Base salary range: $181,000 - $244,000 USD.

The company welcomes people of all backgrounds and hires for who they are, regardless of gender identity or expression, sexual orientation, religion, ethnicity, age, neurodiversity, disability status, citizenship or any other difference.