Commercial GRC Engineer - Sr. Security Engineer

United StatesRemoteFull-timesenior

EngineeringSecurity Engineer

0 views0 saves0 applied

Apply Now

Quick Summary

Overview

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Commercial GRC Engineer - Sr.

Technical Tools

EngineeringSecurity Engineer

This role brings an engineering mindset to commercial Governance, Risk, and Compliance, transforming compliance from a manual process into an automated, continuously monitored capability.
You will build control automation, evidence pipelines, and technical integrations across cloud, identity, endpoint, and SaaS environments.
The position combines hands-on security engineering with GRC expertise, translating compliance requirements into technical controls that engineering teams can implement and consume.
You will help shift compliance left by embedding control requirements into architecture, development workflows, and existing engineering systems.
The role also offers significant ownership across SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks.
Success means improving audit readiness, reducing repetitive evidence collection, and addressing the root causes of control gaps rather than managing symptoms.
This is a builder-focused environment where automation, continuous assurance, systems thinking, and collaboration are central to the way compliance is delivered.

Own control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks by designing automated evidence collection and continuous control monitoring across cloud, identity, endpoint, and SaaS systems.
Express controls, control tests, and cross-framework mappings as version-controlled code so they remain reviewable, testable, reusable, and maintainable.
Translate compliance requirements into technical control logic, workflows, and integrations while partnering with engineering, IT, and security teams to embed controls into existing systems and pipelines.
Shift compliance left by contributing to architecture and design reviews, defining control requirements as acceptance criteria, and helping teams build compliant-by-default infrastructure.
Design engineer-facing compliance experiences, including self-service control status, guardrails, paved-road patterns, and compliance feedback delivered through tools such as CI/CD, Jira, and Slack.
Evaluate whether controls meaningfully reduce relevant risk and propose alternative controls when standard framework requirements do not align with the applicable threat model or workload architecture.
Support audit cycles end-to-end by coordinating evidence requests, maintaining evidence libraries, responding to auditor follow-ups, and tracking remediation items through closure.
Build and maintain dashboards and reporting that provide visibility into control health, evidence freshness, and audit readiness across multiple frameworks.
Identify opportunities to eliminate duplicate evidence-gathering efforts by mapping controls once and reusing those mappings across SOC 2, ISO, and HIPAA.
Diagnose recurring control failures and stale evidence by identifying root causes and improving the underlying processes, tooling, or ownership models.
Partner with GRC and engineering stakeholders to expand control, evidence, and risk-lifecycle capabilities within internal platforms.

Requirements

~2 min read

4+ years of experience in GRC engineering, security engineering, compliance automation, IT audit support, or a related field, with hands-on ownership of at least one complete certification cycle such as SOC 2 or ISO 27001.
Practical experience with GRC or compliance automation platforms such as Vanta, Drata, Secureframe, or comparable internal solutions, including configuring integrations and building evidence pipelines.
Strong understanding of cloud security fundamentals, including AWS, GCP, or Azure IAM, logging, encryption, and their relationship to compliance controls.
Solid working knowledge of SOC 2, ISO 27001, and ideally ISO 27017/27701 and HIPAA requirements, with the ability to map controls across frameworks and reduce duplicated evidence work.
Comfort with scripting or light development using Python, JavaScript, or similar technologies to build integrations, automate evidence collection through APIs, or extend GRC tooling.
Strong written communication skills, with the ability to document controls, gaps, and remediation plans clearly for both external auditors and internal engineering teams.
A stakeholder-focused approach, with an emphasis on making compliance easier for engineers to maintain rather than simply accelerating evidence production.
Demonstrated ability to trace control failures or audit findings to their root causes and drive durable remediation across teams.
Legally eligible to work in the United States on an ongoing basis.