Senior Security Engineer GRC Engineering

Senior individual contributor · India · Reports to the Director of Information Security

One Identity holds certifications because customers require them before they buy, and the ones ahead open international regulatory markets. This role builds the centralized common controls framework, with ISO 27001 and SOC 2 as the base, that each addition maps into. Evidence comes from continuous monitoring, an audit request is answered with a query rather than an email thread, and the next market is a mapping exercise that unlocks revenue opportunities for the company.

We run hosted services in Azure and AWS and ship software customers deploy in their own datacenters, so the evidence sits in cloud control planes, build pipelines, identity systems, and endpoints. Compliance analysts run the assessments and own questionnaire response. This seat builds the systems they draw from: an answer to an auditor and an answer to a customer should come from the same facts.

We're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this seat owns the compliance engineering program. Scope comes from what you ship and from what the auditors accept.

• Own continuous control monitoring end to end: integrations into the identity provider, cloud control planes, code repositories, endpoint management, and ticketing, with alerting and escalation wired in, so a control that degrades reaches its owner with the context to act and the monitoring confirms the fix.
• Build the centralized common controls framework and the artifact layer on it: ISO 27001 and SOC 2 as the base, each new framework mapped against it, and evidence captured, timestamped, and indexed against the control that requires it. A control tested once answers every framework referencing it, and an audit-ready package assembles on demand.
• Hold the platform to its own standard. The evidence system sits inside audit scope, logs its own activity, and operates within the controls it measures.

• Write control validation as code: checks that programmatically test whether a control is implemented, with output an auditor accepts and an engineer can act on. Where a failed check traces to code, the correction arrives as a pull request against the pipeline, policy, or configuration that produced it. PRs, not tickets.
• Partner with the principal infrastructure seat on policy as code. They set the enforcement architecture inside the cloud platform; you make sure every enforced policy emits the evidence the frameworks require.
• Decide where agentic workflows belong in compliance engineering. Control mapping, evidence classification, and first-pass validation are tractable now; attestation is a human act. You set where automation acts, where it recommends, and how its output is verified. The same discipline applies to your own build: automation shares the lift, and nothing ships unverified.

• Own the program's direction. Which frameworks come next, which controls get automated first, and where the engineering effort goes: those calls are this seat's to make and to defend.
• Advance the program's metrics: control health, coverage against the framework map, remediation velocity, and the trend lines leadership steers by, produced from the same data the auditors draw on.
• Integrate cyber risk management into the platform: the risk register and exception handling run on the same control telemetry, automated wherever the workflow allows, with the hands-on remainder worked alongside the compliance analysts. An acceptance carries an owner and an expiry.
• Own asset prioritization as the base layer of the program: which systems and data matter most, kept current through automation, feeding risk decisions, control coverage, and remediation order.
• Front the technical side of audits: walk an assessor through how a control is implemented and how its evidence was produced, in language that holds up under the follow-up question.

Six or more years across compliance program leadership and security or compliance engineering, with time spent on both the framework side and the build side. Equivalent depth counts.

• Depth in at least one of two forms: a major framework carried through assessment under your leadership, FedRAMP or comparable, from readiness through certification or authorization; or GRC engineering you owned end to end, with control telemetry, continuous monitoring, and evidence automation built and run under your direction.
• Strategic framework design: control mapping across frameworks you shaped yourself, and a defensible view on how a common controls framework should be structured.
• Engineering depth you've used recently: Python and API integration work of your own, and hands-on building with AI in the loop within the last six months. We'll ask what you built, when, and how you verified what the tooling produced.

The three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.

This seat brings the engineering function to modernize GRC. You direct where the engineering effort goes, you shape the tooling it runs on, and you build it. The bar is strategic and technical at once: the insight to shape the program and the depth to build the system that runs it, using AI to take lift out of the work without handing it the judgment. If you'd rather build the system that answers the question than answer the question, this is that seat.

One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.

With team members around the globe, we intend to continue to grow revenues and add value to customers.

When you join our team, you will have the opportunity to build and develop products at a scale few others can provide.

Our product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.

Working with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.