Security Engineer, GRC

Role overview Build and improve governance, risk, and compliance programs that support audits, federal compliance, security risk, vendor reviews, policy management, and customer trust. The work combines hands-on control design and workflow improvement with coordination across security, engineering, legal, privacy, and other teams.

Responsibilities - Coordinate cross-functional security and compliance initiatives, maintaining clear ownership and follow-through. - Turn framework requirements into practical controls, policies, procedures, evidence plans, tests, and operational workflows. - Support federal compliance efforts, including assessment preparation, continuous monitoring, remediation, and coordination with assessors. - Improve GRC processes using platforms, integrations, APIs, scripts, webhooks, and ticketing workflows. - Identify and test AI-assisted approaches to GRC work, validating outputs and retaining appropriate human review.

Requirements - At least three years of experience in security, compliance, risk, audit, GRC, program management, or a related technical field. - Experience applying a security or compliance framework such as SOC 2, ISO 27001, NIST 800-53, CMMC, FedRAMP, or PCI DSS. - Ability to manage moderately complex initiatives involving multiple teams. - Skill translating requirements into controls, documentation, evidence, and repeatable processes. - Experience with GRC platforms and workflow automation, such as APIs, scripts, webhooks, ticketing, or cloud and identity integrations. - Active use of AI tools, with sound judgment about validation, reliability, and human oversight.

Nice to have - Experience supporting FedRAMP or a comparable federal program, including authorization boundaries, POA&Ms, continuous monitoring, assessment coordination, or remediation.

Benefits and work setup - Remote role within the United States or Canada, with occasional work travel for team gatherings or industry events. - Benefits include health coverage, paid time off, parental leave top-ups, retirement matching, equity for most employees, and paid volunteer days.