Staff Security Engineer (Compliance) - Moveworks

Description

Compliance work today is mostly manual: screenshots, spreadsheets, and evidence gathered by hand in the weeks before an audit. This role moves that work to automation, so evidence is collected and controls are monitored all the time, and an audit can be passed in any month because the records are already current.

You will approach compliance as software. The focus is on getting the controls actually right, not only on passing their checks. You will help replace legacy processes with automated platforms that grow without extra effort.

The team is looking for an engineer who sees traditional compliance and wants to change it. You know when and where AI helps across the compliance engineering cycle, including writing code, collecting evidence, validating controls, generating documents, streamlining audits, and building new compliance automation.

This is an individual contributor tech lead role with hands-on work.

Responsibilities

• Build and own automated evidence collection pipelines that connect to cloud infrastructure, identity providers, source control, ticketing systems, and other security tools.
• Design and implement continuous control monitoring so compliance is measured in real time, not just during audit periods.
• Replace manual, paper-based processes with software and engineering-first systems.
• Set the technical strategy for future certifications and regulatory frameworks. Assess new requirements and design scalable solutions that keep operational overhead low.
• Apply LLMs and agents to map controls to evidence, check that evidence, and flag drift.
• Lead international compliance initiatives such as ISMAP, IRAP, and C5.
• Manage relationships with auditors so audits run smoothly and stay compliant.
• Work with key stakeholders to make sure controls are implemented and findings are fixed.
• Write and update policies, procedures, and other compliance documents.

Requirements

• At least 8 years in software engineering or information security, with a focus on security compliance and risk management.
• Fluent Japanese in reading, writing, and speaking, required for ISMAP.
• A bachelor's degree in computer science, information technology, cybersecurity, or a related field. Advanced degrees or certifications such as CISM, CISSP, or CISA are preferred.
• A habit of removing recurring manual work by automating it.
• Proven experience developing, managing, and rolling out security policies and compliance frameworks such as ISMAP, IRAP, C5, FedRAMP, ISO 27001, ISO 42001, NIST, GDPR, and SOC 2 Type 2.
• Working knowledge of security principles, controls, and security technologies and products.
• Familiarity with cloud security and the compliance standards of AWS, Azure, and GCP.
• Expert-level knowledge of AWS services.
• Strong written, verbal, and presentation skills for engaging a wide range of stakeholders.
• Ability to identify security risks, put mitigations in place, and drive remediation from start to finish.
• Experience with international and domestic security regulations.

Conditions

Work persona is assigned by role and work location: flexible, remote, or required in office. The company may check the distance between your home and the nearest office with a third-party service to confirm eligibility.