Security & Compliance Engineer (GRC)

Role overview Build automation that gathers compliance evidence from the actual state of cloud systems and helps identify gaps continuously. The role begins with the organization’s own compliance program as a proving ground, then extends to agents that map customer environments to controls and prepare evidence for audits and security questionnaires.

Responsibilities - Develop agents to collect evidence for SOC 2 Type 2 and ISO 27001 from live systems. - Automate access reviews, joiner and leaver checks, and detection of emerging compliance gaps. - Map frameworks such as SOC 2, ISO 27001, and PCI DSS to verified security state. - Generate evidence suitable for auditor review and maintain a source of accurate, evidence-backed questionnaire responses. - Help put initial compliance agents into use internally and with customers.

Requirements - Four to eight years of experience in GRC, security compliance, or cloud security operations. - Hands-on ownership of SOC 2 or ISO 27001 controls, beyond supporting audits. - Experience with a compliance automation platform. - Knowledge of AWS security fundamentals, including IAM, logging, and configuration hygiene. - Python scripting experience for automating evidence collection and checks, along with active use of AI tools. - Precise writing, especially for security questionnaire responses.

Nice to have - Familiarity with PCI DSS, HIPAA, or India’s DPDP Act. - Experience building compliance tooling as a product feature or broader security engineering work.

Benefits and work setup - Full-time remote role with occasional in-person collaboration. - Stock options, family health insurance, and work equipment. - Access to current AI models and agent tools on a small, senior team.