Senior Security Engineer - GRC

Role overview

Build the technical foundation for governance, risk, and compliance across a multi-brand organization. You’ll design a shared control architecture that supports several security and audit frameworks, then keep its controls, evidence, and implementation current as standards change and the business grows.

Responsibilities

- Create and maintain mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, preserving each framework’s requirements while identifying reusable controls. - Own the master control catalog, including its terminology, data model, evidence links, and maintenance process. - Manage control and evidence requirements as new standards are adopted, requirements change, or additional business units enter scope. - Automate evidence collection and build AI-supported workflows for risk analysis, vendor reviews, and compliance monitoring. - Work with security engineering, legal, finance, and product teams to turn control designs into practical implementation guidance. - Identify ways to reduce duplicated effort across frameworks and audits.

Requirements

- At least six years in security engineering, GRC, or compliance engineering, with hands-on work across multiple frameworks. - Strong knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53. - Experience designing or maintaining crosswalks, control frameworks, or unified control architectures. - Practical experience managing control implementation and evidence requirements, beyond writing documentation. - Familiarity with compliance automation platforms and the ability to advise engineering and product teams on technical controls. - Experience building or operating production or near-production AI workflows, such as LLM pipelines, agent systems, or retrieval-augmented generation.

Nice to have

- Experience using AWS services such as Lambda, Step Functions, EventBridge, S3, or Aurora/RDS to build compliance automation. - Serving as a primary technical contact for external audits; experience with multi-brand control harmonization. - Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP, or PCI ISA. - Experience in SaaS or consumer marketplace environments.